SB20261111190 - Ubuntu update for linux-azure-6.8, linux-azure-fde-6.8

Description

This security bulletin contains information about 3326 vulnerabilities.

1) Buffer overflow (CVE-ID: CVE-2023-20585)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to a boundary error in IOMMU. A local administrator can trigger memory corruption and cause loss of SNP guest data integrity.

2) Input validation error (CVE-ID: CVE-2024-52560)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the compare_attr(), mi_new_attt_id(), mi_enum_attr(), mi_format_new() and mi_insert_attr() functions in fs/ntfs3/record.c, within the ni_std(), ni_std5(), ni_find_attr(), ni_enum_attr_ex(), ni_load_attr(), ni_remove_attr(), al_remove_le(), ni_ins_new_attr(), ni_try_remove_attr_list(), ni_create_attr_list(), ni_ins_attr_ext(), ni_insert_attr(), ni_expand_mft_list(), ni_expand_list() and ni_write_inode() functions in fs/ntfs3/frecord.c, within the mi_find_attr() and attr_collapse_range() functions in fs/ntfs3/attrib.c. A local user can perform a denial of service (DoS) attack.

3) NULL pointer dereference (CVE-ID: CVE-2024-53056)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the mtk_crtc_destroy() function in drivers/gpu/drm/mediatek/mtk_crtc.c. A local user can perform a denial of service (DoS) attack.

4) Improper locking (CVE-ID: CVE-2024-56552)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the handle_sched_done() function in drivers/gpu/drm/xe/xe_guc_submit.c. A local user can perform a denial of service (DoS) attack.

5) Input validation error (CVE-ID: CVE-2024-58094)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the jfs_truncate_nolock() function in fs/jfs/inode.c. A local user can perform a denial of service (DoS) attack.

6) Input validation error (CVE-ID: CVE-2024-58095)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the extAlloc() and extRecord() functions in fs/jfs/jfs_extent.c. A local user can perform a denial of service (DoS) attack.

7) Incorrect calculation (CVE-ID: CVE-2025-21687)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 5.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:U/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect calculation within the vfio_platform_read_mmio() and vfio_platform_write_mmio() functions in drivers/vfio/platform/vfio_platform_common.c. A local user can perform a denial of service (DoS) attack.

8) Out-of-bounds read (CVE-ID: CVE-2025-21985)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the populate_dml_output_cfg_from_stream_state() and map_dc_state_into_dml_display_cfg() functions in drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c, within the dml21_map_dc_state_into_dml_display_cfg() function in drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_translation_helper.c. A local user can perform a denial of service (DoS) attack.

9) Out-of-bounds read (CVE-ID: CVE-2025-22104)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the vnic_add_client_data(), send_login(), handle_query_ip_offload_rsp() and handle_login_rsp() functions in drivers/net/ethernet/ibm/ibmvnic.c. A local user can perform a denial of service (DoS) attack.

10) Input validation error (CVE-ID: CVE-2025-22108)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the bnxt_xmit_bd() function in drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c, within the bnxt_start_xmit() and dma_unmap_addr_set() functions in drivers/net/ethernet/broadcom/bnxt/bnxt.c. A local user can perform a denial of service (DoS) attack.

11) Improper locking (CVE-ID: CVE-2025-22127)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the f2fs_read_multi_pages() function in fs/f2fs/data.c, within the f2fs_compress_ctx_add_page() function in fs/f2fs/compress.c. A local user can perform a denial of service (DoS) attack.

12) NULL pointer dereference (CVE-ID: CVE-2025-23131)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the new_lockspace() function in fs/dlm/lockspace.c. A local user can perform a denial of service (DoS) attack.

13) Memory leak (CVE-ID: CVE-2025-37807)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the htab_is_percpu() and htab_percpu_map_gen_lookup() functions in kernel/bpf/hashtab.c. A local user can perform a denial of service (DoS) attack.

14) Resource management error (CVE-ID: CVE-2025-37833)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the niu_try_msix() function in drivers/net/ethernet/sun/niu.c. A local user can perform a denial of service (DoS) attack.

15) Use-after-free (CVE-ID: CVE-2025-38069)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the pci_epf_test_set_bar() and pci_epf_test_free_space() functions in drivers/pci/endpoint/functions/pci-epf-test.c. A local user can escalate privileges on the system.

16) Use-after-free (CVE-ID: CVE-2025-38187)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the r535_gsp_rpc_push() function in drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c. A local user can escalate privileges on the system.

17) NULL pointer dereference (CVE-ID: CVE-2025-38203)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the jfs_ioc_trim() function in fs/jfs/jfs_discard.c. A local user can perform a denial of service (DoS) attack.

18) Out-of-bounds read (CVE-ID: CVE-2025-38204)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the dtInitRoot() and add_missing_indices() functions in fs/jfs/jfs_dtree.c. A local user can perform a denial of service (DoS) attack.

19) Division by zero (CVE-ID: CVE-2025-38205)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a division by zero error within the populate_dummy_dml_surface_cfg() function in drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c. A local user can perform a denial of service (DoS) attack.

20) Double free (CVE-ID: CVE-2025-38206)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the exfat_free_upcase_table() function in fs/exfat/nls.c. A local user can perform a denial of service (DoS) attack.

21) Improper locking (CVE-ID: CVE-2025-38237)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the fimc_is_hw_change_mode() function in drivers/media/platform/samsung/exynos4-is/fimc-is-regs.c. A local user can perform a denial of service (DoS) attack.

22) Memory leak (CVE-ID: CVE-2025-38563)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the perf_mmap_pfn_mkwrite() function in kernel/events/core.c. A local user can perform a denial of service (DoS) attack.

23) Memory leak (CVE-ID: CVE-2025-38565)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the mutex_unlock() and vm_flags_set() functions in kernel/events/core.c. A local user can perform a denial of service (DoS) attack.

24) NULL pointer dereference (CVE-ID: CVE-2025-38621)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the rdev_is_spare() and rdev_addable() functions in drivers/md/md.c. A local user can perform a denial of service (DoS) attack.

25) Improper locking (CVE-ID: CVE-2025-39833)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the hfcpci_softirq() and HFC_init() functions in drivers/isdn/hardware/mISDN/hfcpci.c. A local user can perform a denial of service (DoS) attack.

26) Resource management error (CVE-ID: CVE-2025-39925)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the j1939_sk_netdev_event_netdown() function in net/can/j1939/socket.c. A local user can perform a denial of service (DoS) attack.

27) Out-of-bounds read (CVE-ID: CVE-2025-40014)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the amd_set_spi_freq() function in drivers/spi/spi-amd.c. A local user can perform a denial of service (DoS) attack.

28) Use-after-free (CVE-ID: CVE-2025-40054)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the f2fs_merge_page_bio() function in fs/f2fs/data.c. A local user can escalate privileges on the system.

29) Use-after-free (CVE-ID: CVE-2025-40064)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the smc_pnet_find_ism_by_pnetid() function in net/smc/smc_pnet.c. A local user can escalate privileges on the system.

30) Use-after-free (CVE-ID: CVE-2025-40074)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ipv4_neigh_lookup() function in net/ipv4/route.c. A local user can escalate privileges on the system.

31) NULL pointer dereference (CVE-ID: CVE-2025-40097)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the hda_component_manager_init() function in sound/hda/codecs/side-codecs/hda_component.c. A local user can perform a denial of service (DoS) attack.

32) NULL pointer dereference (CVE-ID: CVE-2025-40098)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the cs35l41_get_acpi_mute_state() function in sound/hda/codecs/side-codecs/cs35l41_hda.c. A local user can perform a denial of service (DoS) attack.

33) Improper error handling (CVE-ID: CVE-2025-40102)

CWE-ID: CWE-388 - Error Handling

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the kvm_arch_vcpu_ioctl() function in arch/arm64/kvm/arm.c. A local user can perform a denial of service (DoS) attack.

34) Use-after-free (CVE-ID: CVE-2025-40139)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the smc_clc_msg_hdr_valid(), smc_clc_prfx_set4_rcu() and smc_clc_prfx_set() functions in net/smc/smc_clc.c. A local user can escalate privileges on the system.

35) Use-after-free (CVE-ID: CVE-2025-40158)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ip6_finish_output2() and ip6_finish_output() functions in net/ipv6/ip6_output.c. A local user can escalate privileges on the system.

36) Use-after-free (CVE-ID: CVE-2025-40168)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the smc_clc_prfx_match6_rcu() function in net/smc/smc_clc.c. A local user can escalate privileges on the system.

37) Incorrect calculation (CVE-ID: CVE-2026-100070)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose internal network details.

The vulnerability exists due to an incorrect calculation of the Contact-header parsing offset in nf_nat_sip when processing a SIP packet whose NAT address translation changes its length. A remote attacker can send a SIP packet containing subsequent Contact headers to disclose internal network details.

Exploitation requires NAT address translation to shorten the packet.

38) Memory leak (CVE-ID: CVE-2026-100071)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource cleanup in HSR device setup error handling when receiving frames after an RX handler has been registered and device setup subsequently fails. A remote attacker can send frames during HSR device setup to cause a denial of service.

39) Incomplete cleanup (CVE-ID: CVE-2026-100075)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incorrect send queue credit accounting.

The vulnerability exists due to incomplete cleanup in the srpt_alloc_rw_ctxs() error unwind path when handling an allocation failure partway through a multi-buffer indirect descriptor. A remote attacker can trigger the error path to cause incorrect send queue credit accounting.

40) Function Call with Incorrectly Specified Arguments (CVE-ID: CVE-2026-100078)

CWE-ID: CWE-628 - Function Call with Incorrectly Specified Arguments

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an incorrect function argument in the iwlwifi MEI cyclic buffer handling code when sending SAP message payloads. A local user can trigger the vulnerable code path to cause a denial of service.

41) Improper resource shutdown or release (CVE-ID: CVE-2026-100079)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to prevent UCSI debugfs entries from being created.

The vulnerability exists due to improper resource cleanup in UCSI debugfs entry teardown when unregistering and registering the same UCSI instance across a remoteproc restart. A local user can trigger repeated UCSI instance unregistration and registration to prevent UCSI debugfs entries from being created.

42) Memory leak (CVE-ID: CVE-2026-23137)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the attach_node_and_children() and unittest_data_add() functions in drivers/of/unittest.c. A local user can perform a denial of service (DoS) attack.

43) Use-after-free (CVE-ID: CVE-2026-23201)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the parse_longname() function in fs/ceph/crypto.c. A local user can escalate privileges on the system.

44) Improper input validation (CVE-ID: CVE-2026-43010)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in bpf_kprobe_multi_link_attach() when attaching a sleepable kprobe_multi program. A local user can attach a sleepable program that invokes sleepable helpers from a non-sleepable context to cause a denial of service.

The issue is triggered because kprobe.multi programs run in atomic/RCU context and cannot sleep.

45) Improper locking (CVE-ID: CVE-2026-43216)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in skb_may_tx_timestamp() when processing transmit timestamps in interrupt context. A local user can trigger transmit timestamp handling to cause a deadlock.

The issue occurs when a driver completes the transmit timestamp from a dedicated interrupt handler while the same lock is already write-locked on the same CPU.

46) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-43344)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of offline CPU and topology lookup conditions in the Intel uncore PMON initialization logic when initializing uncore PCI devices on affected platforms. A local user can trigger the vulnerable code path to cause a denial of service.

The issue can occur when all CPUs associated with a UBOX device are offline or when NUMA is disabled on a NUMA-capable platform.

47) Race condition (CVE-ID: CVE-2026-45897)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect counter values to be reported.

The vulnerability exists due to a race condition in nft_counter when performing concurrent dump-and-reset operations. A local user can trigger parallel counter resets to cause incorrect counter values to be reported.

48) Improper locking (CVE-ID: CVE-2026-45901)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in nf_tables reset path when nft reset, ipset list, and iptables-nft with '-m set' rule run concurrently. A local user can trigger concurrent operations to cause a denial of service.

The issue results from a circular lock dependency involving commit_mutex, nfnl_subsys_ipset, and nlk_cb_mutex.

49) Race condition (CVE-ID: CVE-2026-45944)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a race condition in the Intel VT-d IOMMU context entry teardown logic when tearing down context entries. A local attacker can trigger use of a torn context entry to cause a denial of service.

The issue arises because the hardware may observe a partially updated 128-bit context entry while the Present bit remains set, resulting in unpredictable behavior or spurious faults.

50) Use-after-free (CVE-ID: CVE-2026-45963)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the nau8821 jack detection work handler when unloading the driver while jack detection work is pending. A local user can unload the driver while delayed work remains scheduled to cause a denial of service.

51) Out-of-bounds read (CVE-ID: CVE-2026-46140)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in btmtk_usb_hci_wmt_sync() when processing a short firmware response in a WMT event SKB. A local attacker can provide a specially crafted short firmware response to disclose sensitive information.

52) Improper locking (CVE-ID: CVE-2026-46252)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in regulator_resolve_supply() in the regulator core when handling a failed late enable of a supply regulator. A local user can trigger this error path to cause a denial of service.

53) Improper access control (CVE-ID: CVE-2026-52909)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to move a fallback tunnel device to another network namespace.

The vulnerability exists due to improper access control in the ip6_vti fallback tunnel device initialization when initializing the per-network-namespace fallback device. A local user can move the ip6_vti0 device to another network namespace to move a fallback tunnel device to another network namespace.

The issue affects the per-netns fallback tunnel device ip6_vti0.

54) Improper access control (CVE-ID: CVE-2026-52928)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access control in the AF_UNIX SIOCATMARK ioctl handler when processing SIOCATMARK requests on non-stream sockets. A local user can invoke the ioctl on a SOCK_DGRAM or SOCK_SEQPACKET socket to cause a denial of service.

55) Race condition (CVE-ID: CVE-2026-52988)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in nf_tables commit phase hook list handling in netfilter when publishing new hooks while concurrent netlink dump list traversal via rcu is in progress. A local user can trigger concurrent ruleset updates to cause a denial of service.

56) Use-after-free (CVE-ID: CVE-2026-53005)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the AF_UNIX SOCKMAP handling and garbage collection logic when processing socket buffers carrying SCM file descriptor attributes through SOCKMAP. A local user can send crafted AF_UNIX messages with SCM file descriptor attributes through SOCKMAP to cause a denial of service.

The issue arises because redirected socket buffers are not visible to AF_UNIX garbage collection, and user interaction is not required.

57) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-53027)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of attribute segment run loading in attr_data_get_block_locked() when processing compressed or sparse attributes with frame-aligned clusters. A local user can trigger the affected code path to cause a denial of service.

The issue is triggered when vcn is rounded down to the frame start and vcn and vcn0 reside in different attribute segments.

58) Race condition (CVE-ID: CVE-2026-53070)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in SCTP over UDP transmission handling in net/sctp/ipv6.c and net/sctp/protocol.c when transmitting SCTP packets over UDP. A local user can trigger SCTP over UDP traffic to cause a denial of service.

Exploitation requires SCTP over UDP to be enabled.

59) Out-of-bounds read (CVE-ID: CVE-2026-53078)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in BPF sock_ops context field access handling when accessing ctx fields with the same destination and source register. A local user can trigger the flawed register handling to cause a denial of service.

The issue occurs when the fullsock or locked_tcp_sock check is false, causing a stale ctx pointer to be retained and used as a bogus socket pointer.

60) Out-of-bounds read (CVE-ID: CVE-2026-53078)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in BPF sock_ops context field access handling when accessing ctx fields with the same destination and source register. A local user can trigger the flawed register handling to disclose sensitive information.

The issue occurs when the fullsock or locked_tcp_sock check is false, causing a stale ctx pointer to be retained.

61) Use-after-free (CVE-ID: CVE-2026-53089)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in bpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns() when querying info for an offloaded BPF map or program during network namespace destruction. A local user can query crafted offloaded BPF map or program information to cause a denial of service.

The issue occurs because the associated network namespace may be racing with teardown and its reference count may already have reached zero.

62) Improper access control (CVE-ID: CVE-2026-53090)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass BPF verifier checks.

The vulnerability exists due to improper access control in the Linux kernel BPF verifier when analyzing ld_{abs,ind} instructions in subprograms. A local user can load a crafted BPF program to bypass BPF verifier checks.

The issue affects subprograms where ld_{abs,ind} instructions are permitted, including cases involving BTF-annotated subprograms with scalar return types.

63) Memory leak (CVE-ID: CVE-2026-53102)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in the mt76 wireless driver MCU request handling code when processing error paths after allocating an skb. A local user can trigger an intermediate failure to cause a denial of service.

64) Improper resource shutdown or release (CVE-ID: CVE-2026-53113)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in ath11k beacon template setup functions when handling error paths during beacon template setup. A local user can trigger error conditions in beacon template setup to cause a denial of service.

The issue affects the ath11k driver code paths in ath11k_mac_setup_bcn_tmpl_ema() and ath11k_mac_setup_bcn_tmpl_mbssid().

65) Use-after-free (CVE-ID: CVE-2026-53157)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in phonet_device_destroy() when walking the per-net phonet device list with RCU readers after device removal. A local user can trigger destruction of a phonet_device while concurrent readers still hold a stale pointer to cause a denial of service.

The issue arises because the object is removed with RCU list semantics but may be freed before the RCU grace period has elapsed.

66) NULL pointer dereference (CVE-ID: CVE-2026-53163)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in remove_waiter() in the rtmutex futex proxy locking path when handling FUTEX_CMP_REQUEUE_PI operations during deadlock detection or proxy lock acquisition. A local user can invoke crafted futex operations to cause a denial of service.

67) Use of uninitialized resource (CVE-ID: CVE-2026-53167)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an exposure of uninitialized memory in FUSE_NOTIFY_RETRIEVE in fs/fuse/dev.c when retrieving data from page cache folios. A local user can trigger FUSE_NOTIFY_RETRIEVE on a non-uptodate folio to disclose sensitive information.

This has security impact only on systems that do not enable automatic zero-initialization of page allocations.

68) Use-after-free (CVE-ID: CVE-2026-53226)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the rockchip gpio irq domain handling in drivers/gpio/gpio-rockchip.c when removing a gpio bank and later processing generic irq chip suspend, resume, or shutdown callbacks. A local user can trigger device removal so that stale generic irq chip entries are later dereferenced to cause a denial of service.

The issue is associated with leaked domain generic chip structures that remain on the global gc_list after the gpio bank has been removed.

69) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-53250)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause out-of-bounds memory access.

The vulnerability exists due to a time-of-check time-of-use race condition in xsk_skb_metadata() when processing transmit metadata from a userspace-writable UMEM buffer. A local user can race to overwrite csum_start and csum_offset between validation and assignment to cause out-of-bounds memory access.

The issue occurs during checksum computation in the transmit path.

70) NULL pointer dereference (CVE-ID: CVE-2026-53313)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in dc_dmub_srv_log_diagnostic_data() and dc_dmub_srv_enable_dpia_trace() when handling error paths. A local user can trigger the vulnerable code path to cause a denial of service.

71) Improper handling of exceptional conditions (CVE-ID: CVE-2026-53325)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in agp_amd64_probe() in the AMD64 AGP driver when probing for AMD northbridge hardware in a virtualized environment without a physical AMD northbridge. A local user can trigger driver initialization to cause a denial of service.

The issue occurs because a negative error from cache_nbs() is not handled correctly, allowing initialization to continue until a NULL pointer is dereferenced in amd64_fetch_size().

72) Improper locking (CVE-ID: CVE-2026-53327)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock state handling in debugobjects fill_pool logic in lib/debugobjects.c when refilling the debug object pool on RT-enabled kernels while the current task is blocked on an rt_mutex. A local user can trigger the vulnerable code path to cause a denial of service.

Only RT-enabled kernel configurations are affected.

73) Race condition (CVE-ID: CVE-2026-53361)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in unix_gc() and unix_peek_fpl() in the af_unix garbage collection logic when processing MSG_PEEK operations during garbage collection scheduling. A local user can trigger concurrent garbage collection activity to cause a denial of service.

The issue occurs because gc_in_progress may be false while unix_gc() is running, which can confuse garbage collection by MSG_PEEK.

74) Out-of-bounds write (CVE-ID: CVE-2026-53362) Exploited

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to an out-of-bounds write in __ip6_append_data() when processing UDPv6 socket data with MSG_MORE and MSG_SPLICE_PAGES on the paged allocation path. A local user can send crafted data through a UDPv6 socket to corrupt kernel memory.

The issue occurs when fraggap is non-zero and the paged-allocation branch is taken, causing writes past skb->end into trailing skb_shared_info.

75) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-53365)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in virtio vsock zerocopy completion handling in net/vmw_vsock/virtio_transport_common.c when processing multi-skb MSG_ZEROCOPY sends. A local user can send a large crafted message that is fragmented into multiple skbs to cause a denial of service.

The issue can leave pinned user pages without completion notification, including when the send loop exits before the final skb is processed.

76) Out-of-bounds write (CVE-ID: CVE-2026-53366)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in __ip_append_data() when processing IPv4 packet data on the paged allocation path. A local user can trigger the faulty length calculations to cause a denial of service.

The issue occurs because fraggap bytes copied from the previous skb are placed into the new skb linear area while the allocation size does not account for those bytes.

77) Use-after-free (CVE-ID: CVE-2026-53381)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in fuse_release_end() during virtiofs auto_submount unmount processing when releasing files during submount unmount after the superblock has already been destroyed. A local user can trigger submount unmount activity to cause a denial of service.

The issue affects the virtiofs auto_submounts case, where the wait counter is tracked per connection rather than per superblock.

78) NULL pointer dereference (CVE-ID: CVE-2026-53382)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in vidtv_mux_push_si when handling PID contexts during stream information processing. A local user can trigger allocation failure conditions that leave a PID context unset to cause a denial of service.

The issue can lead to a general protection fault in the vidtv test driver workqueue path.

79) Improper access control (CVE-ID: CVE-2026-53383)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper access control in smb2_check_user_session() and the ksmbd compound request handling path when processing a crafted compound SMB request with a non-valid session. A remote attacker can send a specially crafted compound request to cause a denial of service.

By using SESSION_SETUP as the first compound operation and a related TREE_CONNECT request with SessionId set to ULLONG_MAX as the second operation, an in-progress session can reach a NULL pointer dereference because sess->user remains NULL.

80) Use-after-free (CVE-ID: CVE-2026-53384)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a use-after-free in the 8250_dw serial driver when handling a failed clock notifier registration during device probe. A local user can trigger the error path and access the stale port slot to cause a denial of service or execute arbitrary code.

The issue occurs because the 8250 port remains registered after probe failure while its associated driver data has already been freed.

81) NULL pointer dereference (CVE-ID: CVE-2026-53385)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference caused by a race condition in vcs_notifier() in drivers/tty/vt/vc_screen.c when handling concurrent vcs_write operations. A local user can trigger concurrent write activity to cause a denial of service.

The issue occurs after the console lock is temporarily dropped and re-acquired, allowing the vc_data pointer to become stale before notifier processing.

82) Out-of-bounds read (CVE-ID: CVE-2026-53387)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the veml6075_request_measurement function when processing the VEML6075_CONF_IT register value. A local user can trigger an out-of-range index value to cause a denial of service.

Exploitation requires fault device behavior, misprogramming, or bus corruption to produce a reserved register value.

83) Use-after-free (CVE-ID: CVE-2026-53388)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in fuse_try_move_folio() in the FUSE subsystem when moving a page cache folio during FUSE read handling. A local user can trigger a race condition to cause a denial of service.

The issue occurs because the request is not re-locked on the success path, allowing request abortion to free fuse_io_args while subsequent copy logic still accesses it.

84) Use-after-free (CVE-ID: CVE-2026-53389)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a use-after-free in tcp_ao_delete_key() in net/ipv4/tcp_ao.c when deleting a TCP-AO key asynchronously and later querying TCP_AO_INFO. A local user can delete a key with del_async enabled after setting it as the current or rnext key to disclose sensitive information.

The issue occurs when a key was assigned as the current or rnext key while the socket was in CLOSE state and the socket is later transitioned to LISTEN.

85) Out-of-bounds read (CVE-ID: CVE-2026-53390)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in smb_check_perm_dacl() when processing a crafted security descriptor during an SMB2_CREATE access check. A remote user can store a crafted ACE via SMB2_SET_INFO to disclose sensitive information.

Exploitation is reachable on a share that uses ACL xattrs, and the malformed descriptor is processed on a subsequent access check.

86) NULL pointer dereference (CVE-ID: CVE-2026-53391)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in nfs4_decode_mp_ds_addr() when processing a crafted GETDEVICEINFO multipath-DS body containing a zero-length r_addr or r_netid value. A remote attacker can send malicious metadata server responses to cause a denial of service.

The issue is reachable from a pNFS-flexfile client mounted against a malicious or compromised metadata server.

87) Improper input validation (CVE-ID: CVE-2026-53392)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in ff_layout_alloc_lseg() in the NFSv4 flexfiles layout handling when processing a malformed flexfiles layout body with a zero filehandle-version array count. A remote attacker can send a specially crafted flexfiles layout to cause a denial of service.

The issue can lead to a null pointer dereference and kernel panic.

88) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-53393)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause silent data loss.

The vulnerability exists due to improper state management in nfsd_vfs_write() and nfsd_commit() when handling deferred writeback errors for UNSTABLE write data followed by COMMIT. A remote user can trigger writeback errors and then issue COMMIT operations to cause silent data loss.

The issue violates the UNSTABLE+COMMIT durability contract by returning an unchanged write verifier after failed writeback.

89) Memory leak (CVE-ID: CVE-2026-53397)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a memory leak in the nfsd SETACL request decoding and release handling when processing crafted NFS ACL SETACL requests. A remote user can send a specially crafted SETACL request that triggers a decode failure after partial ACL allocation to cause a denial of service.

The leaked posix_acl object remains allocated for the lifetime of the server.

90) Improper Initialization (CVE-ID: CVE-2026-53398)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper initialization in nfsd4_decode_secinfo_no_name() when processing a truncated XDR stream for the SECINFO_NO_NAME operation. A remote attacker can send a specially crafted request to cause a denial of service.

The issue occurs because stale union contents from a previous operation can leave sin_exp non-NULL, leading the error cleanup path to call exp_put() on an invalid value.

91) Use-after-free (CVE-ID: CVE-2026-53399)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a use-after-free in the nfsd layout stateid handling in fs/nfsd/nfs4layouts.c when processing layout stateid allocation failures after a setlease error. A remote user can trigger a setlease failure and subsequent IDR walker access to dereference a dangling pointer to cause a denial of service.

The issue occurs because a published stateid remains referenced in the IDR after the associated memory is freed, and a related destructor path may access uninitialized delayed work on the same failure path.

92) Race condition (CVE-ID: CVE-2026-53400)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the i2c adapter registration logic when looking up adapters by id during registration. A local user can trigger concurrent adapter lookup and registration activity to cause a denial of service.

The issue can lead to access to uninitialized adapter data, including NULL-pointer dereferences or use-after-free.

93) Out-of-bounds read (CVE-ID: CVE-2026-53402)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in fbcon_do_set_font() and subsequent rendering in the fbcon console subsystem when handling a failed font change rollback and later rendering user-controlled character indices. A local user can trigger a font change failure and then supply character indices greater than 255 to disclose sensitive information.

Exploitation requires a failure in the font-setting error path that leaves the console state desynchronized after vc_resize() fails.

94) NULL pointer dereference (CVE-ID: CVE-2026-53403)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in fb_videomode_to_var in the fbdev subsystem when processing a userspace-supplied modelist that does not contain the current framebuffer mode. A local user can supply a crafted mode list to trigger a kernel crash and cause a denial of service.

Exploitation requires fbcon to be unbound so that the current mode is left without a matching entry before a later console takeover occurs.

95) Out-of-bounds write (CVE-ID: CVE-2026-63794)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in sev_dbg_crypt() when processing crafted KVM SEV debug encryption requests. A local user can send a crafted ioctl request with page offsets that cause the transfer length to exceed the destination page boundary to cause memory corruption.

The issue affects the encrypt path and can overflow a single-page intermediate buffer by up to 15 bytes when the destination offset is greater than the source offset.

96) Use-after-free (CVE-ID: CVE-2026-63795)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in p9_client_walk() when handling a failed non-cloning walk after a request has been sent. A local user can trigger a multi-component walk split into multiple p9_client_walk() calls to cause a denial of service.

The issue occurs because fid may alias oldfid, causing a reference owned by the caller to be dropped while the caller still expects the object to remain valid.

97) Out-of-bounds read (CVE-ID: CVE-2026-63796)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the ocfs2 group descriptor bitmap handling in fs/ocfs2/suballoc.c when processing a crafted group bitmap descriptor. A local user can provide a descriptor with oversized bg_size or bg_bits values to cause a denial of service.

Exploitation requires access to a malicious ocfs2 filesystem image or on-disk metadata.

98) Use-after-free (CVE-ID: CVE-2026-63797)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in rpmsg_chrdev_probe() and the rpmsg character device endpoint callback handling in drivers/rpmsg/rpmsg_char.c when processing callbacks during a probe error path. A local user can trigger endpoint creation failure and concurrent callback handling to cause a denial of service.

The issue occurs because the default endpoint's priv pointer can reference freed memory before endpoint setup has completed.

99) Use-after-free (CVE-ID: CVE-2026-63798)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the irq-imgpdc driver when handling interrupts after driver removal. A local user can trigger spurious interrupts that access freed memory to cause a denial of service.

The issue involves dangling chained handlers for peripheral and syswake interrupts, and generic chips may remain reachable by interrupt chip suspend, resume, or shutdown callbacks after the driver has been removed.

100) Use-after-free (CVE-ID: CVE-2026-63800)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in pnfs_update_layout() when handling the NFS_LAYOUT_RETURN branch. A local user can trigger the vulnerable code path to cause a denial of service.

101) Use-after-free (CVE-ID: CVE-2026-63801)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in tipc_aead_decrypt_done in the TIPC crypto subsystem when processing crafted encrypted frames during asynchronous decryption. A remote attacker can send crafted encrypted frames to trigger a read from freed memory and cause a denial of service.

Exploitation requires the asynchronous decryption path to be used and can occur while the associated network namespace is being torn down.

102) Use-after-free (CVE-ID: CVE-2026-63802)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in __blkcg_rstat_flush() when releasing multiple blkgs in the same blkcg concurrently. A local user can trigger concurrent blkg release operations to cause a denial of service.

The race occurs when one blkg removes another blkg's iostat entries via llist_del_all() while the other blkg is still being processed.

103) Use-after-free (CVE-ID: CVE-2026-63803)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the hdlc ppp per-protocol timer handling when detaching the ppp protocol or re-attaching it while timers are still active. A local user can trigger protocol teardown while a timer callback is executing to cause a denial of service.

The issue affects LCP, IPCP, and IPV6CP control protocol timers embedded in the PPP state.

104) Use-after-free (CVE-ID: CVE-2026-63804)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in gfs2_qd_dealloc when processing pending RCU callbacks during filesystem unmount. A local user can trigger quota object disposal and unmount-related cleanup to cause a denial of service.

The issue occurs because an RCU callback may access the superblock after it has already been freed.

105) Reachable assertion (CVE-ID: CVE-2026-63806)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an improper handling of unaligned memory access in ioeventfd datamatch handling in KVM when processing a guest store that splits a page and targets emulated MMIO with a datamatch-enabled ioeventfd. A local user can trigger a specially crafted guest store operation to cause a denial of service.

Exploitation requires a guest configuration where the second page contains a datamatch-enabled ioeventfd at offset 0.

106) Out-of-bounds read (CVE-ID: CVE-2026-63807)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in the KVM x86 shadow MMU hugepage recovery logic when recovering hugepages for a direct shadow page whose gfn falls outside the target memslot. A local user can create a guest hugepage mapping that extends below the bounds of a memslot to cause a denial of service.

The issue can manifest as a host page fault in kernel mode during hugepage recovery.

107) Use-after-free (CVE-ID: CVE-2026-63808)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in exfat_find_dir_entry() when parsing a crafted exFAT filesystem image. A local user can supply a crafted exFAT image to trigger a kernel fault and cause a denial of service.

The issue occurs on the TYPE_EXTEND path after a directory entry buffer is released and then dereferenced.

108) Release of invalid pointer or reference (CVE-ID: CVE-2026-63809)

CWE-ID: CWE-763 - Release of invalid pointer or reference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to memory corruption in proc_sys_call_handler and __cgroup_bpf_run_filter_sysctl() when processing a sysctl write that replaces the temporary buffer. A local privileged user can write a crafted sysctl value to trigger memory corruption and cause a denial of service.

Exploitation requires access to write to a sysctl entry from a task in the target cgroup, and the fault was reproduced while writing to /proc/sys/kernel/domainname.

109) NULL pointer dereference (CVE-ID: CVE-2026-63810)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the bdev pseudo-filesystem when userspace mounts it and accesses files. A local attacker can mount the pseudo-filesystem and access files to cause a denial of service.

The issue is triggered through move_mount() using inode_operations pointers that are equal to 0 for this pseudo-filesystem.

110) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-63812)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in __destroy_extent_node() and the f2fs extent cache when handling extent node destruction and concurrent writeback. A local user can trigger inode eviction or writeback activity to cause a kernel sanity check failure and filesystem inconsistency.

The issue can leave the cached largest extent stale after the FI_NO_EXTENT flag is set, and concurrency with writeback is involved in the affected path.

111) Out-of-bounds read (CVE-ID: CVE-2026-63814)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in f2fs_acl_from_disk() when parsing a malformed ACL xattr. A local user can supply a crafted ACL entry layout to trigger an out-of-bounds read and cause a denial of service.

The issue occurs because ACL_USER or ACL_GROUP entries can be placed in a slot that contains only a short ACL entry.

112) Out-of-bounds read (CVE-ID: CVE-2026-63815)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in f2fs_fill_dentries() and inline directory handling when mounting a crafted filesystem image and reading an inline directory. A local user can mount a specially crafted image and read a crafted directory to disclose sensitive information.

Exploitation requires the flexible_inline_xattr feature to be enabled.

113) Use-after-free (CVE-ID: CVE-2026-63816)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the f2fs garbage collection code when handling F2FS_IOC_GARBAGE_COLLECT_RANGE on a copy-on-write file. A local user can trigger garbage collection while the associated atomic inode is being evicted to cause a denial of service.

The issue involves access to atomic_inode->i_mapping without holding a reference to the atomic inode.

114) Improper access control (CVE-ID: CVE-2026-63817)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access control in f2fs_iget() meta inode handling when processing a corrupted directory entry with an inode number equal to max_nid while compress_cache is disabled. A local user can create a corrupted directory entry to cause a denial of service.

Only F2FS mounts with compression support present and the compress_cache mount option disabled are affected by this behavior.

115) Out-of-bounds read (CVE-ID: CVE-2026-63818)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in f2fs_recover_orphan_inodes() when mounting a crafted f2fs image and replaying orphan inodes from the checkpoint pack. A local user can provide a crafted filesystem image with a corrupted orphan block entry count to cause a denial of service.

The issue occurs when the orphan block entry count is larger than F2FS_ORPHANS_PER_BLOCK, causing the recovery code to read past the ino[] array and interpret subsequent data as inode numbers.

116) Improper handling of exceptional conditions (CVE-ID: CVE-2026-63821)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in rtw_usb_write_data() and rtw_usb_tx_agg_skb() when handling USB write submission failures. A local user can trigger a USB write failure to cause a denial of service.

The issue can be triggered during device disconnect or reconnect scenarios and under memory pressure conditions.

117) Double free (CVE-ID: CVE-2026-63822)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in the ath11k dp tx_status buffer handling when unbinding a device after an initialization error related to firmware. A local user can trigger device initialization failure and subsequent unbinding to cause a denial of service.

The issue is reproducible in a VM when MSI addressing initialization fails.

118) Use-after-free (CVE-ID: CVE-2026-63823)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in request_key_auth handling in the Linux kernel key management subsystem when processing KEYCTL_INSTANTIATE_IOV or related key instantiation and rejection paths concurrently with request_key() completion. A local user can trigger concurrent key operations to cause a denial of service.

The issue occurs because the request_key_auth payload can be freed after helper completion while another path later resumes and accesses rka->target_key.

119) Out-of-bounds write (CVE-ID: CVE-2026-63824)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to a buffer overflow in keyctl_pkey_params_get_2() when processing crafted keyctl public-key operation parameters. A local user can provide a too small buffer length to cause memory corruption.

120) Use-after-free (CVE-ID: CVE-2026-63826)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in store_modes() and related framebuffer mode handling in fbdev when processing crafted framebuffer mode changes through ioctl or sysfs interfaces. A local user can trigger stale mode pointer dereferences to cause a denial of service.

The issue involves stale pointers in fb_display[i].mode and fb_info->mode after the framebuffer modelist is replaced and the old list is freed.

121) Use-after-free (CVE-ID: CVE-2026-63827)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in aa_replace_profiles() during rawdata_list deduplication when processing policy replacement operations. A local user can trigger AppArmor profile replacement with crafted timing to cause a denial of service.

The issue occurs because entries can remain on the rawdata list after their profile reference count has reached zero and before deferred cleanup runs.

122) Improper access control (CVE-ID: CVE-2026-63828)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass AppArmor connect restrictions.

The vulnerability exists due to improper access control in apparmor_socket_sendmsg() when processing sendmsg()/sendto() calls with MSG_FASTOPEN and a supplied destination address. A local user can send a crafted fast open request to bypass AppArmor connect restrictions.

The issue affects implicit TCP and MPTCP connection establishment performed as part of sendmsg() fast open handling.

123) Improper access control (CVE-ID: CVE-2026-63829)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify tunnel configuration across network namespaces.

The vulnerability exists due to improper access control in ipgre_changelink() and erspan_changelink() when handling RTM_NEWLINK changelink requests for GRE tunnel devices. A local privileged user can send a crafted RTM_NEWLINK request to modify tunnel configuration across network namespaces.

The issue occurs when the device network namespace differs from the tunnel link network namespace, because the check was performed only against dev_net(dev).

124) Improper access control (CVE-ID: CVE-2026-63830)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to modify the page cache contents.

The vulnerability exists due to improper access control in the sk_msg scatter-gather handling logic when processing SK_MSG transformations and BPF message helpers. A local user can trigger scatterlist entry transfers, shifts, splits, or copies that desynchronize sg.copy state to modify the page cache contents.

Exploitation requires the ability to reach a later SK_MSG verdict that exposes sg_virt(sge) as writable BPF ctx->data.

125) Use-after-free (CVE-ID: CVE-2026-63831)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or corrupt data.

The vulnerability exists due to use-after-free in the mac802154 llsec crypto processing in net/mac802154/llsec.c when performing in-place cryptographic transformations on shared skb data. A local user can trigger concurrent 802.15.4 traffic with security enabled to cause a denial of service or corrupt data.

The issue can affect both RX and TX paths when skb data buffers are shared across clones.

126) Improper access control (CVE-ID: CVE-2026-63833)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to improper access control in the ntfs3 xattr handler when handling direct userspace writes to reserved $LX* extended attributes. A local user can set crafted $LXUID, $LXGID, $LXMOD, or $LXDEV values on a file they own to escalate privileges.

Exploitation requires a writable ntfs3 mount and relies on inode reload of WSL permission metadata into inode ownership and mode fields.

127) Resource exhaustion (CVE-ID: CVE-2026-63834)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the batman-adv tp_meter unacked_list handling when processing crafted messages with small lengths and seqno gaps. A remote attacker can send specially crafted messages to cause a denial of service.

The issue can lead to an out-of-memory condition or excessive CPU usage from management overhead while searching the enlarged list.

128) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-63835)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in batadv_v_ogm_queue_on_if() and the OGM aggregation queue handling when processing OGM aggregation on a disabled hard interface. A local user can trigger interface disablement while causing new skbs to be queued to the aggregation list to cause a denial of service.

The issue can lead to skbs being queued after the worker has been disabled, and these queued skbs are never freed or consumed.

129) Integer overflow (CVE-ID: CVE-2026-63836)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow leading to divide-by-zero in batadv_tp_update_cwnd() in the batman-adv tp_meter component when processing crafted acknowledgment traffic. A local user can trigger the vulnerable calculation to cause a denial of service.

The issue occurs when the congestion window reaches 0x20000000, causing a left shift in the divisor to wrap to zero under 32-bit arithmetic.

130) Integer underflow (CVE-ID: CVE-2026-63940)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer underflow in KVM SEV Port I/O handling in arch/x86/kvm/svm/sev.c when processing Port I/O requests with a length or count of 0. A local user can trigger a zero-length Port I/O request to cause a denial of service.

The issue affects the handling of VMGEXIT and string I/O requests in the KVM SEV implementation.

131) Improper resource shutdown or release (CVE-ID: CVE-2026-63970)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in virtio_transport_alloc_skb() in the vsock/virtio transport when processing fixed-buffer vectored zerocopy input that hits MAX_SKB_FRAGS. A local user can trigger a partial attachment of managed fragments to cause a denial of service.

Exploitation occurs on the rollback path after io_sg_from_iter() returns -EMSGSIZE, causing an skb with managed fragment references but no bound uarg to be freed through the ordinary fragment unref path.

132) Use-after-free (CVE-ID: CVE-2026-64017)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in blk-mq cached request handling in block/blk-mq.c when submitting a bio while a cached request is peeked and the task sleeps before it is removed from the plug list. A local user can trigger request handling that hits this race condition to cause a denial of service.

The issue occurs when a plug flush frees cached requests before the cached request is popped for use.

133) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-64070)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in sysfs show() callbacks in arch/powerpc/perf/hv-gpci.c when handling repeated sysfs reads. A local user can repeatedly read the affected sysfs entries to cause a denial of service.

On CONFIG_PREEMPT=y kernels, repeated successful reads can leave preemption disabled and a subsequent user-mode page fault may be forced to SIGSEGV, with the resulting coredump triggering a kernel scheduling while atomic condition.

134) Use of Uninitialized Variable (CVE-ID: CVE-2026-64082)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt register state and disclose kernel stack contents.

The vulnerability exists due to use of uninitialized stack data in compat_riscv_gpr_set() and compat_restore_sigcontext() when handling failed user memory copies. A local user can provide crafted user-supplied register or signal context data that triggers a copy failure to corrupt register state and disclose kernel stack contents.

The issue affects the RISC-V compatibility signal and ptrace handling paths.

135) NULL pointer dereference (CVE-ID: CVE-2026-64187)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in xlog_recover_reorder_trans in the XFS log recovery code when processing a crafted log during filesystem recovery. A local user can provide a crafted log item with no regions to trigger a kernel fault and cause a denial of service.

This issue only occurs for crafted log data during recovery, as the normal runtime commit path does not generate such a transaction.

136) Use-after-free (CVE-ID: CVE-2026-64188)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in rmnet_dellink() and the rmnet endpoint handling in the Qualcomm rmnet driver when processing network packets on the receive path while an endpoint is being removed. A local user can trigger concurrent packet processing and endpoint deletion to cause a denial of service.

The stale read occurs when lockless RCU readers dereference the egress_dev pointer after the endpoint memory has been freed.

137) Use-after-free (CVE-ID: CVE-2026-64189)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in ip_set_dump_do() and ip_set_dump_done() in the ipset netfilter subsystem when handling netlink dump operations concurrently with ip_set_list resizing. A local user can trigger concurrent netlink dump and set creation operations to cause a denial of service.

The issue can lead to a general protection fault and kernel panic.

138) Out-of-bounds read (CVE-ID: CVE-2026-64191)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds read and out-of-bounds write in stub_xfer() in the i2c-stub driver when handling an I2C_SMBUS ioctl with I2C_SMBUS_I2C_BLOCK_DATA and an invalid block length. A local user can issue a crafted ioctl request with data->block[0] greater than 32 to cause a denial of service.

The issue affects the development and test i2c-stub driver, which is not built by default and must be loaded with a chip_addr= parameter.

139) Out-of-bounds write (CVE-ID: CVE-2026-64192)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in BPF_MAP_TYPE_INODE_STORAGE handling when creating and updating inode storage maps while the BPF LSM is uninitialized. A local privileged user can create and update a BPF_MAP_TYPE_INODE_STORAGE map to cause a denial of service.

This issue occurs when CONFIG_BPF_LSM is enabled but the BPF LSM is not enabled at boot time, causing the inode security blob offset to remain uninitialized and leading to a kernel panic during later RCU callback execution.

140) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64205)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in i801_access() in the i2c-i801 driver when handling an error path after a failed pre-check. A local user can trigger concurrent access to the SMBus controller to cause a denial of service.

The issue occurs when the driver clears SMBus hardware status and ownership state without actually owning the controller, which can corrupt the SMBus hardware state machine and lead to a console livelock and hung task panic.

141) Deadlock (CVE-ID: CVE-2026-64206)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper locking in the Bluetooth L2CAP connection teardown path when canceling pending receive work during connection deletion. A remote attacker can trigger Bluetooth L2CAP traffic and connection teardown to cause a denial of service.

The issue can deadlock between the pending_rx_work worker and the teardown path in l2cap_conn_del().

142) Race condition (CVE-ID: CVE-2026-64210)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the mlx5e ICOSQ handling in the Linux kernel mlx5 driver when processing NAPI poll work during CPU affinity changes. A local user can trigger concurrent ICOSQ operations to cause a denial of service.

The issue occurs when affinity changes while XSK work remains pending.

143) Improper resource shutdown or release (CVE-ID: CVE-2026-64241)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the gpio-rockchip driver remove path when handling device teardown and stray interrupts after driver removal. A local user can trigger a stray interrupt after the driver is removed to cause a denial of service.

The issue involves an uncleared chained IRQ handler that can leave a stale handler reachable after unbind.

144) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64244)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper state management in add_memory_block() and memory_block_release() when handling failed memory block registration. A local attacker can trigger a failure during memory block registration to cause a denial of service.

This issue can be triggered when __add_memory_block() fails at xa_store() under memory pressure, leading to a kernel WARN_ON on mem->altmap.

145) Use-after-free (CVE-ID: CVE-2026-64245)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in fb_find_mode() in the fbdev modedb component when processing a NULL mode option. A local user can trigger the vulnerable code path to cause a denial of service.

146) Use-after-free (CVE-ID: CVE-2026-64246)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in linkstation_poweroff_init() when initializing the linkstation poweroff driver. A local attacker can trigger the vulnerable initialization path to cause a denial of service.

147) Out-of-bounds read (CVE-ID: CVE-2026-64247)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in hv_is_vp_in_sparse_set() when handling a paravirtual TLB flush for an L2 guest with a copied VP ID from the enlightened VMCS. A local user can provide a crafted VP ID value to cause a denial of service.

The issue can also cause KVM to perform an unnecessary TLB flush for an L2 vCPU.

148) Use-after-free (CVE-ID: CVE-2026-64249)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in child_regions_with_firmware() in drivers/fpga/of-fpga-region.c when handling child FPGA region data. A local user can trigger the error path to cause a denial of service.

149) Improper resource shutdown or release (CVE-ID: CVE-2026-64254)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in ntb_epf_deinit_pci() in the NTB EPF driver when tearing down PCI mappings for BARs that share the same mapped I/O memory. A local user can trigger module removal or device teardown to cause a denial of service.

The issue occurs when PEER_SPAD and CONFIG share a single PCI BAR.

150) Integer overflow (CVE-ID: CVE-2026-64256)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in dqiterate in fs/xfs/scrub/dqiterate.c when iterating quota records. A local user can trigger processing of a filesystem containing a quota record with the maximum quota id to cause a denial of service.

The issue can cause the iteration to wrap to zero and start over.

151) Use-after-free (CVE-ID: CVE-2026-64266)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in fuse_ref_folio() in the FUSE subsystem when handling a subsequent copy chain after unlocking the request. A local user can trigger request abort and asynchronous end callback timing to cause a denial of service.

152) Out-of-bounds write (CVE-ID: CVE-2026-64268)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to write out of bounds.

The vulnerability exists due to an out-of-bounds write in siw_proc_rresp() in drivers/infiniband/sw/siw/siw_qp_rx.c when processing Read Response DDP segments for an outstanding RREAD over an established RDMA connection. A remote user can send Read Response segments with more total payload than requested while keeping the DDP Last flag clear to write out of bounds.

Exploitation requires a connected siw peer on an established RDMA connection over routable TCP.

153) Out-of-bounds read (CVE-ID: CVE-2026-64269)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.

The vulnerability exists due to an out-of-bounds read in rdma_write_sg when processing an RTRS READ response with an attacker-controlled descriptor length. A remote attacker can advertise a crafted desc[0].len value larger than max_chunk_size to disclose sensitive information or cause a denial of service.

With no IOMMU or in passthrough mode, adjacent host memory may be returned to the peer; with a translating IOMMU, the out-of-range access is expected to fault and abort the connection.

154) Stack-based buffer overflow (CVE-ID: CVE-2026-64270)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to overwrite stack memory and cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in mms114_interrupt() when processing a device-reported packet size from the touchscreen controller over the I2C bus. A local attacker can tamper with the I2C bus or use a malicious controller to supply an oversized packet size to overwrite stack memory and cause a denial of service.

The out-of-bounds write occurs on the IRQ-thread stack and may overwrite the stack canary, saved registers, and the return address.

155) Out-of-bounds write (CVE-ID: CVE-2026-64271)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to overwrite heap memory.

The vulnerability exists due to out-of-bounds write in the tw_interrupt() handler in drivers/input/touchscreen/touchwin.c when processing serial input from a Touchwindow peripheral. An attacker with physical access can send crafted non-zero bytes with mismatched second and third packet bytes to overwrite heap memory.

Exploitation requires a malicious, malfunctioning, or counterfeit Touchwindow peripheral.

156) Memory corruption (CVE-ID: CVE-2026-64272)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory access in the mms114 touchscreen driver when processing touch data packets from MMS134S and MMS136 controllers. A local user can trigger crafted touch event data to cause a denial of service.

The issue affects handling of touch events beyond the first one because 6-byte events are parsed using 8-byte structure indexing.

157) Out-of-bounds write (CVE-ID: CVE-2026-64273)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to corrupt kernel memory.

The vulnerability exists due to an out-of-bounds write in iforce_process_packet() when processing a device-reported force-feedback status packet. An attacker with physical access can supply a crafted device payload with an out-of-range effect index to corrupt kernel memory.

The issue affects both USB interrupt endpoint and serio transports, and the status handling path is not gated on force-feedback support being present.

158) Stack-based buffer overflow (CVE-ID: CVE-2026-64274)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to a stack-based out-of-bounds write in goodix_ts_read_input_report() when processing device-reported touch contact data. A remote attacker can tamper with the I2C bus or use a malicious controller to write beyond an on-stack buffer and cause memory corruption.

The issue occurs because the maximum contact count taken from a 4-bit device configuration field can exceed the number of contacts the buffer is sized to hold.

159) Integer underflow (CVE-ID: CVE-2026-64275)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to integer underflow in the touch reporting logic of the elan_i2c touchpad driver when handling small calculated or fallback width values. A local attacker can cause width values smaller than ETP_FWIDTH_REDUCE to trigger an underflow and report a massive unsigned integer to userspace.

The issue affects touch width reporting to userspace.

160) Division by zero (CVE-ID: CVE-2026-64275)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to division by zero in the elan_i2c touchpad driver when processing invalid device firmware or device tree parameters during device probe. A local attacker can provide zero trace-count values to trigger a kernel panic.

The issue occurs during device probe.

161) Out-of-bounds read (CVE-ID: CVE-2026-64276)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or disclose sensitive information.

The vulnerability exists due to out-of-bounds read and out-of-bounds write in the rmi_f30_attention handler and EVIOCGKEYCODE/EVIOCSKEYCODE ioctl handling in the synaptics-rmi4 F30 driver when processing a device that reports a gpioled_count greater than 6 with GPIO support enabled. A local user can trigger the attention interrupt or use EVIOCGKEYCODE/EVIOCSKEYCODE ioctls to cause a denial of service or disclose sensitive information.

The issue occurs because the keymap allocation is smaller than the gpioled_count value used for iteration and keycode bounds.

162) Out-of-bounds read (CVE-ID: CVE-2026-64277)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information and overwrite adjacent kernel memory.

The vulnerability exists due to an out-of-bounds read and out-of-bounds write in the synaptics-rmi4 F3A GPIO keymap handling in drivers/input/rmi4/rmi_f3a.c when processing a device that reports a gpio_count greater than the allocated keymap size. A local user can open the evdev node and invoke keymap ioctls to disclose sensitive information and overwrite adjacent kernel memory.

The information disclosure occurs through EVIOCGKEYCODE leaking adjacent slab memory to user space, while EVIOCSKEYCODE writes a caller-controlled value past the buffer.

163) Use-after-free (CVE-ID: CVE-2026-64279)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the i2c core adapter lookup and deregistration logic when looking up an adapter by id during adapter deregistration or registration failure. A local user can trigger a race condition to cause a denial of service.

164) Improper input validation (CVE-ID: CVE-2026-64280)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in afu_ioctl_dma_map() when handling a DFL_FPGA_PORT_DMA_MAP ioctl request with a user-supplied length. A local user can provide an excessively large length value to cause a denial of service.

165) Use-after-free (CVE-ID: CVE-2026-64286)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a stale pointer in flush_hyp_vcpu() when copying the host vCPU context into the hyp private vCPU. A local user can provide a crafted __hyp_running_vcpu value to cause a denial of service.

The issue occurs on arm64 KVM with pKVM at EL2 during vCPU context handling.

166) Out-of-bounds read (CVE-ID: CVE-2026-64287)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in flush_hyp_vcpu() and the vGIC list register save and restore logic when copying host-controlled vgic_v3 state into the pKVM hyp vCPU. A local privileged user can provide a crafted used_lrs value to trigger out-of-bounds access at EL2 to cause a denial of service.

The issue affects arm64 KVM with pKVM and involves host-to-EL2 state transfer.

167) Improper input validation (CVE-ID: CVE-2026-64289)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in iommufd_hwpt_invalidate() when processing user-controlled invalidation parameters through the ioctl interface. A local user can supply a large entry_len or entry_num value to cause a denial of service.

The issue can trigger a soft-lockup watchdog event or pin the CPU in a non-preemptible kernel during invalidation processing.

168) Improper access control (CVE-ID: CVE-2026-64294)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in the mincore() and madvise(MADV_PAGEOUT) ownership checks when handling files on idmapped mounts. A local user can access these interfaces on a crafted idmapped mount to disclose sensitive information.

The issue affects side-channel protection logic and occurs because ownership was checked against an idmap that ignored the file's mount idmap.

169) Out-of-bounds write (CVE-ID: CVE-2026-64296)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read and write.

The vulnerability exists due to an out-of-bounds write in exfat_find_dir_entry() when parsing crafted exfat directory entries containing many short name fragments. A local user can provide a crafted directory structure to cause an out-of-bounds read and write.

The issue occurs because the per-entry output pointer advances by a fixed amount while the tracked accumulated name length can remain smaller when a name fragment contains an early NUL.

170) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-64297)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in module decompression in kernel/module/decompress.c when processing a module for loading. A local user can trigger an allocation failure condition to cause a denial of service.

The issue can lead to a kernel oops due to a dereference of ZERO_SIZE_PTR after a failed allocation.

171) Improper access control (CVE-ID: CVE-2026-64298)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass file write permission checks and truncate a file.

The vulnerability exists due to improper access control in nfs_open_permission_mask() when handling open requests with O_TRUNC on NFSv4 delegated opens. A local user can open a file with O_RDONLY | O_TRUNC to bypass file write permission checks and truncate a file.

This issue occurs when the client satisfies the OPEN locally from a cached write delegation and then sends truncation to the server using delegation state.

172) Out-of-bounds read (CVE-ID: CVE-2026-64299)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in regex_match_glob() glob matching in the tracing event filter subsystem when processing non-NUL-terminated string event fields. A local user can supply a crafted glob filter against such fields to disclose sensitive information.

One reported path reaches the issue from the xfs_lookup tracepoint, and the affected string fields may be dynamic char arrays copied without a trailing NUL byte.

173) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-64301)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a reference count leak in scmi_regulator_probe() in the SCMI regulator driver when processing device tree child nodes. A local user can trigger an error condition during device probing to cause a denial of service.

174) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64303)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption or trigger a use-after-free.

The vulnerability exists due to improper resource shutdown in the fsl-lpspi dma transfer error path in drivers/spi/spi-fsl-lpspi.c when preparing a tx dma descriptor after the rx dma channel has already been submitted and issued. A local user can trigger a tx prepare failure during a spi dma transfer to cause memory corruption or trigger a use-after-free.

The issue occurs because the spi core unmaps dma buffers after the error is returned while the rx dma engine may continue writing to those buffers.

175) Out-of-bounds write (CVE-ID: CVE-2026-64304)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in qat_rsa_setkey_crt() when processing RSA CRT key components larger than half of the key size. A local user can provide a crafted RSA CRT key to cause memory corruption.

The issue occurs because CRT components are bounded by the modulus size in the generic RSA key parser, while the QAT driver allocates half-size DMA buffers for those components.

176) Use-after-free (CVE-ID: CVE-2026-64305)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the qat service_table list handling in adf_init.c when iterating over registered services during device lifecycle and notification operations. A local user can trigger concurrent service registration or unregistration during list traversal to cause a denial of service.

The issue can also lead to list corruption during concurrent access.

177) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-64306)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper handling of error conditions in drbg_ctr_generate() when processing additional input during CTR_DRBG generation. A local user can trigger a failure in drbg_ctr_update() to disclose sensitive information.

The output buffer may remain uninitialized when the function incorrectly reports success.

178) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-64312)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper callback handling in the pcrypt aead fallback path in crypto/pcrypt.c when processing non-parallel fallback after padata submission returns -EBUSY. A local user can trigger asynchronous cryptographic operations that use the fallback path to cause a denial of service.

179) Integer overflow (CVE-ID: CVE-2026-64313)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect cryptographic computation.

The vulnerability exists due to an integer overflow in crypto/ecc.c when performing elliptic curve multiplication. A local user can trigger the vulnerable arithmetic path to cause incorrect cryptographic computation.

180) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-64315)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into log files in the caam crypto driver setkey handlers when dumping key material during key setup with dynamic debug enabled. A local user can access debug output containing sensitive key material to disclose sensitive information.

Exposure occurs at runtime when CONFIG_DYNAMIC_DEBUG is enabled.

181) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-64316)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into log files in the caam crypto driver key-dump code when handling key material in *_setkey() and gen_split_key(). A local user can access debug output containing sensitive key material to disclose sensitive information.

Exposure occurs at runtime when CONFIG_DYNAMIC_DEBUG is enabled.

182) Out-of-bounds read (CVE-ID: CVE-2026-64317)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Rock Ridge SL record handling in fs/isofs/rock.c when parsing a crafted ISO 9660 image containing a malformed symbolic link record. A local user can supply a crafted filesystem image to disclose sensitive information.

The issue can copy adjacent kernel memory into the symlink body returned to user space by readlink().

183) Out-of-bounds read (CVE-ID: CVE-2026-64318)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the aix partition parser when scanning the physical-partition-extent array from a crafted AIX/IBM partition table. A local user can supply a crafted block-device image to disclose sensitive information.

The issue can be triggered during partition scanning without mounting the filesystem, including when a crafted image is attached with partition scanning enabled or when a device is auto-scanned by udev.

184) Out-of-bounds read (CVE-ID: CVE-2026-64319)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in nvmet_auth_reply() when processing a crafted DHCHAP_REPLY message. A remote attacker can send a specially crafted authentication reply message with inconsistent hash and DH value lengths to disclose sensitive information.

Exploitation is possible pre-authentication when DH authentication is configured.

185) Out-of-bounds read (CVE-ID: CVE-2026-64320)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.

The vulnerability exists due to an out-of-bounds heap read in nvmet_execute_disc_get_log_page() in the NVMe target discovery controller when handling a host-supplied log page offset in a Discovery Get Log Page request. A remote attacker can send a specially crafted request with an out-of-range offset to disclose sensitive information or cause a denial of service.

The issue is reachable before authentication by any TCP, RDMA, or FC peer that can reach the nvmet target.

186) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-64321)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a reference count leak in nvmet_rdma_queue_connect() in the nvme target rdma component when handling queue connect requests while the host queue backlog is exceeded. A remote attacker can send connection requests that trigger the busy return path to cause a denial of service.

187) Out-of-bounds write (CVE-ID: CVE-2026-64322)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information and corrupt memory.

The vulnerability exists due to out-of-bounds read and out-of-bounds write in udf sparing table handling in fs/udf/super.c when parsing a crafted UDF image. A local user can mount or otherwise trigger processing of a specially crafted UDF image to disclose sensitive information and corrupt memory.

The issue is caused by validating reallocationTableLen as a byte count even though it is later used as an entry count for sparingEntry array access.

188) Out-of-bounds read (CVE-ID: CVE-2026-64323)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in udf_load_vat() and udf_get_pblock_virt15() when mounting a crafted UDF image with a virtual (VAT) partition. A local user can provide a crafted UDF image with an oversized VAT header length to disclose sensitive information.

User interaction is required to mount the crafted filesystem image.

189) Out-of-bounds read (CVE-ID: CVE-2026-64324)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in udf_free_blocks() and block bitmap handling in fs/udf/balloc.c when processing crafted UDF filesystem block extents. A local user can supply a crafted filesystem and truncate a writable file on it to cause a denial of service.

On systems where active users can mount removable UDF media without administrative privileges, user interaction is not required beyond mounting the media and truncating a file.

190) Improper handling of exceptional conditions (CVE-ID: CVE-2026-64326)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exceptional condition handling in bdev_mark_dead() when processing surprise removal of a block device. A local user can trigger surprise device removal to cause a denial of service.

The issue can hang indefinitely while waiting for writeback that can no longer complete, wedging the reset worker and tasks waiting on it.

191) Use-after-free (CVE-ID: CVE-2026-64329)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the ucsi_ccg_remove() remove path and threaded IRQ handler when handling connector-change events during device removal. A local user can trigger concurrent remove and IRQ activity to cause a denial of service.

The issue arises from a race condition where an in-flight IRQ handler may access a freed ucsi object.

192) Out-of-bounds read (CVE-ID: CVE-2026-64330)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incorrect registration of alternate modes.

The vulnerability exists due to an out-of-bounds read in svdm_consume_modes() when processing partner-supplied SVDM Discovery Modes data. A remote attacker can inject crafted SVDM values and drive the SVID index out of bounds to cause incorrect registration of alternate modes.

The issue can read adjacent fields in struct tcpm_port, and a connected USB Type-C partner can influence the loaded SVID value.

193) NULL pointer dereference (CVE-ID: CVE-2026-64331)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in vep_dequeue() when cancelling FunctionFS AIO requests. A local user can trigger request cancellation on the FunctionFS AIO path to cause a denial of service.

The issue is reachable when stressing FunctionFS endpoints via AIO in usbip's vudc path.

194) Memory leak (CVE-ID: CVE-2026-64332)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory management in the ULPI device registration logic in drivers/usb/common/ulpi.c when handling early ULPI device registration failures. A local user can trigger a registration failure to cause a denial of service.

195) Out-of-bounds write (CVE-ID: CVE-2026-64333)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to memory corruption in digi_write_inb_command() in the digi_acceleport usb serial driver when handling usb serial write commands while the write urb is in use. A local user can trigger a timeout or no-timeout command path to corrupt the write urb buffer to cause memory corruption.

On 32-bit systems, one corruption path is triggered by a broken jiffies comparison after several minutes of system uptime, while commands such as break control can corrupt the urb immediately when no timeout is used.

196) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-64334)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in the digi_acceleport USB serial driver when sending out-of-band commands during operations that race with device disconnect. A local user can trigger operations such as open, set_termios, or close while the device is being disconnected to cause a denial of service.

The issue can result in an indefinite loop with interrupts disabled, leading to a hard lockup.

197) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64335)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the digi_acceleport usb serial driver when reopening a port after it was closed while throttled. A local user can close and reopen a throttled port to cause a denial of service.

The issue prevents the port from receiving further data until the device is reconnected or the driver is rebound.

198) Information disclosure (CVE-ID: CVE-2026-64336)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an information leak in the keyspan_pda USB serial driver write() callback when handling write operations. A local user can trigger a write operation that causes the line discipline to continue reading data beyond the tty write buffer to disclose sensitive information.

The issue occurs because the driver may report accepting more characters than were actually passed to write().

199) Improper resource shutdown or release (CVE-ID: CVE-2026-64337)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the mtu3_gadget_queue() function when queuing a USB gadget request and transfer preparation fails. A local user can trigger a queue failure to cause a denial of service.

The issue occurs because a DMA mapping remains active on the failed queue path before the request is linked on the endpoint request list.

200) Improper resource shutdown or release (CVE-ID: CVE-2026-64338)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in uss720_probe() when handling a probe failure after reading the 1284 register. A local attacker can trigger a failed probe with a device that causes get_1284_register() to fail to cause a denial of service.

The issue can leave a registered parport device behind with stale private_data after the common cleanup path releases the associated private data and USB device reference.

201) Use-after-free (CVE-ID: CVE-2026-64340)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the legousbtower USB driver when handling a race between device release and disconnect. A local user can trigger the race condition by opening and releasing the device while it is being disconnected to cause a denial of service.

The issue arises from object lifetime management during concurrent disconnect and release operations.

202) Use-after-free (CVE-ID: CVE-2026-64341)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in the iowarrior USB driver when release() races with disconnect(). A local user can trigger device release and disconnection in a racing condition to cause a denial of service or execute arbitrary code.

Exploitation requires access to the affected USB device interface.

203) Use-after-free (CVE-ID: CVE-2026-64342)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in the iowarrior USB driver disconnect handling when processing device disconnect events with submitted write URBs still active. A local user can trigger device disconnect while write completion handling is still possible to cause a denial of service or execute arbitrary code.

Exploitation requires local access to the affected USB device interface.

204) Use-after-free (CVE-ID: CVE-2026-64343)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to use-after-free in the ldusb driver when release() races with disconnect(). A local user can trigger a device disconnect while releasing the device to cause a use-after-free.

The issue affects the drivers/usb/misc/ldusb.c code path in the Linux kernel.

205) Use-after-free (CVE-ID: CVE-2026-64344)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in the idmouse USB driver when release() races with disconnect(). A local user can trigger a device disconnect while the device file is being released to cause a denial of service or execute arbitrary code.

Exploitation requires a race condition involving device disconnection and file release in the idmouse driver.

206) Improper update of reference count (CVE-ID: CVE-2026-64345)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference count handling in the printer_open function in the f_printer USB gadget driver when opening the character device while it is already open. A local user can repeatedly attempt a second open to cause a denial of service.

207) Use-after-free (CVE-ID: CVE-2026-64346)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in gadget_match_driver() in the usb gadget udc core when handling concurrent gadget removal and configfs access. A local user can trigger a race condition via configfs operations to cause a denial of service.

The issue arises because the udc and gadget lifecycles are decoupled, and concurrent mode-switch work can free the udc structure while it is still being accessed.

208) Out-of-bounds read (CVE-ID: CVE-2026-64347)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the USB OTG handler in composite_setup() when handling a control transfer with an empty configuration list. A remote attacker can trigger the vulnerable code path to cause a denial of service.

The issue can occur during a teardown race on gadget unbind with a control transfer in flight, or when a driver sets is_otg before adding a configuration.

209) Memory leak (CVE-ID: CVE-2026-64348)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in the EHCI and FOTG210 isochronous submit handling when submitting a URB before it is linked to the endpoint queue. A local user can trigger a failed submit to cause a denial of service.

Exploitation requires access to a system using EHCI or FOTG210 USB isochronous transfers.

210) Memory leak (CVE-ID: CVE-2026-64350)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in cdnsp_alloc_stream_info() when handling stream ring allocation or stream mapping update failures. A local user can trigger allocation failure conditions to cause a denial of service.

211) Out-of-bounds read (CVE-ID: CVE-2026-64351)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in kalmia_rx_fixup() when processing a crafted short bulk-in frame from a USB device. An attacker with physical access can provide malformed frame lengths to disclose sensitive information.

The issue occurs when framing headers are not both present before frame-length subtraction, causing an integer underflow that lets a device-supplied packet length drive buffer access past the end of the rx buffer.

212) Improper locking (CVE-ID: CVE-2026-64352)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in the lpm trie implementation when sleepable BPF programs access LPM maps. A local user can trigger lockdep warnings through crafted BPF map lookup, update, or delete operations to cause a denial of service.

This issue is lockdep-only on debug kernels and can spam the console when a sleepable BPF LSM hook touches an LPM trie.

213) Out-of-bounds read (CVE-ID: CVE-2026-64355)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in dev_map_enqueue_clone() and dev_map_redirect_clone() when cloning fragmented native XDP frames or nonlinear generic XDP packets for devmap broadcast redirects. A local user can trigger clone-based broadcast handling with a crafted fragmented frame to cause a denial of service.

The issue occurs because fragment metadata is not present in the linear cloned frame, and later frame return can interpret uninitialized tail data as skb_shared_info.

214) NULL pointer dereference (CVE-ID: CVE-2026-64358)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a null workqueue callback in mtk_jpeg_release() when releasing a JPEG device context on platforms that do not use the workqueue. A local user can trigger release of the affected device context to cause a denial of service.

The issue results in a WARN_ON condition in __flush_work() because cancel_work_sync() is invoked even when no workqueue callback is defined.

215) Improper input validation (CVE-ID: CVE-2026-64359)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in nilfs_clean_segments when processing user-supplied segment numbers through the CLEAN_SEGMENTS ioctl. A local user can submit out-of-range segment numbers to cause a denial of service.

The issue can hold ns_segctor_sem long enough to block concurrent filesystem operations such as chmod().

216) Use of Uninitialized Variable (CVE-ID: CVE-2026-64360)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of uninitialized memory in hfs_bnode_read() in the hfs and hfsplus bnode handling code when reading bnode data with an invalid offset or a corrected zero length. A local user can trigger an early return and cause callers to use uninitialized stack data to disclose sensitive information.

217) Integer overflow (CVE-ID: CVE-2026-64361)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in check_and_correct_requested_length() in the hfs and hfsplus filesystem code when processing crafted filesystem metadata. A local user can trigger an underflowed length value that bypasses a bounds check to cause a denial of service.

Exploitation can result in a read far beyond the node buffer during a subsequent memmove operation.

218) Use-after-free (CVE-ID: CVE-2026-64362)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to use-after-free in the hid-lg-g15 driver work handling logic when a pending work item is triggered and the device is unplugged. An attacker with physical access can trigger a backlight cycle key event and disconnect the keyboard to cause a denial of service.

The issue is reachable as a race condition on device unplug for G15, G15 v2, and G510 models that initialize the work item.

219) Use-after-free (CVE-ID: CVE-2026-64363)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to execute arbitrary code or cause a denial of service.

The vulnerability exists due to use-after-free in the appleir HID driver when processing concurrent device teardown and timer or raw event handling. A local attacker can trigger device disconnection shortly after key events to execute arbitrary code or cause a denial of service.

Exploitation requires a pending key-up timer or concurrent raw event activity to race with device removal.

220) Out-of-bounds write (CVE-ID: CVE-2026-64364)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to out-of-bounds write in the HID multitouch driver when processing input from a crafted USB or Bluetooth HID multitouch device that advertises a large contact count. An attacker with physical access can provide a crafted device to corrupt adjacent members of struct mt_device and cause a denial of service.

The issue is reachable from an untrusted USB or Bluetooth HID multitouch device, and the kernel panic can be triggered from timer context through the sticky-fingers release path.

221) Use-after-free (CVE-ID: CVE-2026-64365)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a use-after-free condition.

The vulnerability exists due to use-after-free in the letsketch HID driver inrange_timer handling when unbinding the device or during the probe error path after raw events arm the timer. An attacker with physical access can trigger device removal or induce the vulnerable cleanup sequence to cause a use-after-free condition.

The issue can be triggered by USB unplug or module removal, and also on the probe error path if I/O has already been enabled and the timer was armed before cleanup.

222) Improper Initialization (CVE-ID: CVE-2026-64368)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper initialization in slab allocation handling in mm/slub.c when allocating kmalloc objects with zeroing enabled. A local user can trigger a memory allocation pattern that leaves part of the allocated object uninitialized to disclose sensitive information.

The issue occurs when requested-size tracking is not enabled while red zoning alone is enabled, which can break krealloc() __GFP_ZERO expectations.

223) Improper handling of exceptional conditions (CVE-ID: CVE-2026-64369)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in load_unaligned_zeropad() and the s390 secure storage access exception handler when reading unaligned data across page boundaries involving donated secure-execution pages. A local user can trigger the vulnerable kernel access pattern to cause a denial of service.

The issue can result in an endless exception loop when the second page access raises an exception for pages donated to the Ultravisor for secure execution purposes.

224) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-64370)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a reference count leak in do_cpu_nanosleep() when handling an error after creating a POSIX CPU timer. A local user can trigger a failure in posix_cpu_timer_set() to cause a denial of service.

225) Race condition (CVE-ID: CVE-2026-64371)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in procfs handlers for task statistics, wchan, map_files, and namespace links when accessing process information during concurrent exec state updates without exec_update_lock protection. A local user can access affected /proc interfaces to disclose sensitive information.

The issue involves calls to ptrace_may_access() without the required exec_update_lock protection.

226) Use-after-free (CVE-ID: CVE-2026-64372)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in pcc_cpufreq_do_osc() when performing two-phase _OSC negotiation through acpi_evaluate_object(). A local attacker can trigger the vulnerable code path to cause a denial of service.

The issue also involves a double free after the stale pointer is freed again.

227) Race condition (CVE-ID: CVE-2026-64373)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in cpufreq_suspend() when rebooting the system while cpu hotplug operations run concurrently. A local user can trigger a reboot while concurrent cpu hotplug activity causes governor_data to be freed during access to cause a denial of service.

The issue can result in a kernel null pointer dereference during the reboot path because processes and kernel threads remain active.

228) Deadlock (CVE-ID: CVE-2026-64374)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a live lock condition in the linux kernel scheduler RT_PUSH_IPI logic when handling RT task migration and repeated inter-processor interrupts on non-PREEMPT_RT systems. A local user can trigger heavy networking activity and wake RT tasks to cause a denial of service.

The issue occurs on non-PREEMPT_RT systems when softirqs execute for long periods and prevent the target CPU from returning to task context.

229) Race condition (CVE-ID: CVE-2026-64375)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a race condition in proc_pid_get_link() and proc_pid_readlink() when handling access to /proc pid link targets. A local user can trigger concurrent task state changes to disclose sensitive information.

The issue affects file descriptor-related proc links and involves ptrace_may_access() checks performed on a different task lookup than the one used for the actual access.

230) Improper update of reference count (CVE-ID: CVE-2026-64376)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference count management in firmware_upload_register() in drivers/base/firmware_loader/sysfs_upload.c when handling an error after alloc_lookup_fw_priv() fails. A local user can trigger the vulnerable error path to cause a denial of service.

231) Double free (CVE-ID: CVE-2026-64377)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in qcom_cpufreq_hw_cpu_exit() when releasing CPU policy data. A local user can trigger CPU policy teardown to cause a denial of service.

The issue occurs because driver_data may reference devm-managed memory, including an interior element of a per-domain array rather than the original allocation base.

232) Race condition (CVE-ID: CVE-2026-64378)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in cgroup_writeback_umount() and inode_switch_wbs()/cleanup_offline_cgwb() when unmounting a filesystem while switching inode writeback state. A local user can trigger a container exit or unmount operation during concurrent writeback activity to cause a denial of service.

The issue can lead to busy inodes after unmount and a subsequent use-after-free in writeback cleanup paths.

233) Improper input validation (CVE-ID: CVE-2026-64379)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to modify file mode bits.

The vulnerability exists due to improper input validation in parse_dacl() when processing a server-provided NFS mode SID. A remote attacker can provide crafted mode values to modify file mode bits.

The issue occurs when modefromsid is active.

234) Out-of-bounds read (CVE-ID: CVE-2026-64380)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in posix_info_sid_size() in the SMB client when parsing truncated POSIX SIDs. A remote attacker can send a specially crafted SMB response to cause a denial of service.

235) Memory leak (CVE-ID: CVE-2026-64381)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in receive_encrypted_standard() when processing compound SMB PDUs. A remote attacker can send compound SMB messages that exceed MAX_COMPOUND to cause a denial of service.

The issue affects the Linux kernel SMB client.

236) Double free (CVE-ID: CVE-2026-64382)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in SMB2_open() when handling replayable error conditions during SMB2 open request processing. A local user can trigger a replayable error that leads to stale response buffer bookkeeping to cause a denial of service.

The issue affects the Linux kernel SMB client implementation.

237) Double free (CVE-ID: CVE-2026-64383)

CWE-ID: CWE-415 - Double Free

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to double free in SMB2_flush() when handling replay attempts for flush responses. A remote user can trigger a replayable flush response followed by a failed retry to cause a denial of service.

238) Double free (CVE-ID: CVE-2026-64384)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in SMB change notify handling in fs/smb/client/smb2pdu.c when processing replayable error conditions during change notify requests. A local user can trigger a replayable error and subsequent cleanup to free the same response buffer twice to cause a denial of service.

239) Double free (CVE-ID: CVE-2026-64385)

CWE-ID: CWE-415 - Double Free

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to double free in SMB2_ioctl() when handling replayable ioctl responses. A remote user can trigger a replayable error condition to cause a denial of service.

240) Double free (CVE-ID: CVE-2026-64386)

CWE-ID: CWE-415 - Double Free

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a double free in query_info() in the smb client when handling replayable query_info requests. A remote user can trigger a replayable error sequence to cause a denial of service.

241) Double free (CVE-ID: CVE-2026-64387)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in SMB2_query_directory in the SMB client when handling replayed query directory responses and reinitialization failures. A local user can trigger a replayable error and subsequent cleanup conditions to cause a denial of service.

242) Use-after-free (CVE-ID: CVE-2026-64390)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in ksmbd byte-range lock handling when processing smb2 lock requests in smb3 multichannel environments. A remote attacker can trigger concurrent lock traversal and removal to cause a denial of service.

The issue occurs because a lock list entry can be removed under a different spinlock than the one protecting the list it belongs to.

243) Improper access control (CVE-ID: CVE-2026-64391)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass permission checks for alternate data stream I/O.

The vulnerability exists due to improper access control in ksmbd alternate data stream handling when processing read and write operations on alternate data streams. A remote user can access a file over SMB and perform alternate data stream read or write operations to bypass permission checks for alternate data stream I/O.

Alternate data streams are stored as extended attributes, and the vulnerable paths recheck inode permissions and LSM policy using the current task credentials instead of the credentials captured when the SMB handle was opened.

244) Improper access control (CVE-ID: CVE-2026-64392)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass filesystem permission checks and delete files or remove ADS xattrs.

The vulnerability exists due to improper access control in ksmbd delete-on-close handling when tearing down deferred or durable handles without request work. A remote user can open a file and trigger delete-on-close processing to bypass filesystem permission checks and delete files or remove ADS xattrs.

The issue occurs because final close operations run with ksmbd worker credentials instead of the credentials captured when the file was opened.

245) Improper access control (CVE-ID: CVE-2026-64393)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass intended permission checks.

The vulnerability exists due to improper access control in SMB2 SET_INFO handlers when processing SET_INFO requests. A remote user can send a specially crafted SET_INFO request to bypass intended permission checks.

The issue arises because path-based VFS helpers perform permission and LSM checks using worker credentials instead of the credentials captured when the file handle was opened.

246) Improper access control (CVE-ID: CVE-2026-64394)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to modify file access control metadata to grant additional access.

The vulnerability exists due to improper access control in smb2_set_info_sec() when handling SMB2_SET_INFO requests with InfoType SMB2_O_INFO_SECURITY. A remote user can send a specially crafted SMB2_SET_INFO request over a handle opened with FILE_WRITE_ATTRIBUTES only to modify file access control metadata to grant additional access.

The issue affects the SECURITY arm of SMB2 SET_INFO, where no per-handle check for FILE_WRITE_DAC or FILE_WRITE_OWNER is performed before rewriting the file's owner or DACL.

247) Improper access control (CVE-ID: CVE-2026-64395)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in FSCTL_DUPLICATE_EXTENTS_TO_FILE handling in ksmbd when processing duplicate extents requests. A remote user can use a source handle opened without read access to copy file contents into an attacker-readable destination to disclose sensitive information.

The issue affects the source file access check before invoking file range clone or copy operations.

248) Use-after-free (CVE-ID: CVE-2026-64396)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to use-after-free in the SMB2 lock handling logic in fs/smb/server/smb2pdu.c when canceling a deferred SMB2_LOCK request. A remote user can send crafted SMB lock and cancellation requests to cause a denial of service.

The issue is triggered by a race between deferred-lock cleanup and asynchronous cancellation while processing blocking byte-range locks.

249) Use-after-free (CVE-ID: CVE-2026-64397)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a use-after-free in smb2_query_dir() and the ksmbd directory enumeration state when handling concurrent QUERY_DIRECTORY requests using the same file handle. A remote user can send concurrent QUERY_DIRECTORY requests on the same file handle to cause a denial of service.

The issue occurs because a pointer to stack-allocated private data is stored in shared readdir state and can be overwritten while an iterate_dir() callback is still using it.

250) Improper access control (CVE-ID: CVE-2026-64398)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to modify file data without the required file write permission.

The vulnerability exists due to improper access control in smb2_ioctl() when processing FSCTL_SET_ZERO_DATA requests. A remote user can use a handle opened with only FILE_WRITE_ATTRIBUTES to zero file data and modify file contents without the required FILE_WRITE_DATA right.

The issue affects ksmbd, and the advisory states it was reproduced by an authenticated SMB client using a handle that was granted FILE_WRITE_ATTRIBUTES but not FILE_WRITE_DATA.

251) Improper access control (CVE-ID: CVE-2026-64399)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to overwrite file data.

The vulnerability exists due to improper access control in the FSCTL_DUPLICATE_EXTENTS_TO_FILE arm of smb2_ioctl() when processing SMB ioctl requests that clone file ranges. A remote user can use the operation on a read-only share or with a destination handle lacking FILE_WRITE_DATA permission to overwrite file data.

The issue affects destination files through vfs_clone_file_range() and can be triggered with a handle opened with only FILE_WRITE_ATTRIBUTES.

252) Use-after-free (CVE-ID: CVE-2026-64401)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the SMB client witness notification handling in fs/smb/client/cifs_swn.c when processing witness notifications for shared registrations. A local user can trigger notification handling involving a freed tcon pointer to cause a denial of service.

Exploitation requires a same-share second mount so that a registration remains live after the first tcon is unregistered and freed.

253) Out-of-bounds write (CVE-ID: CVE-2026-64402)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in smb_sync_perf_buffer() when copying hardware trace data into perf AUX ring buffer pages. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs when the SMB sink is used as a perf AUX sink.

254) Out-of-bounds read (CVE-ID: CVE-2026-64403)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in l2cap_get_conf_opt() when parsing L2CAP configuration options. A remote attacker can send a specially crafted Bluetooth L2CAP packet to cause a denial of service.

The read occurs before the malformed option is rejected, and up to 4 bytes may be read past the end of the buffer.

255) NULL pointer dereference (CVE-ID: CVE-2026-64404)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in iso_conn_big_sync() when handling recvmsg on a PA-sync broadcast sink socket during connection teardown. A local user can trigger a race condition to cause a denial of service.

The issue is reachable from iso_sock_recvmsg() for a PA-sync broadcast sink socket with BT_SK_DEFER_SETUP and BT_SK_PA_SYNC set.

256) NULL pointer dereference (CVE-ID: CVE-2026-64405)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in hci_abort_conn() when handling connection cancellation from the hci_rx_work() receive path. A local user can trigger a pending Bluetooth connection state to cause a denial of service.

The issue can lead to a general protection fault while a connection request is pending and hdev->sent_cmd is NULL.

257) Use-after-free (CVE-ID: CVE-2026-64406)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in bt_accept_dequeue() when handling Bluetooth L2CAP socket cleanup and accept queue processing. A local user can trigger socket state transitions that cause freed memory to be accessed to cause a denial of service.

The issue was observed during listening L2CAP socket cleanup.

258) Out-of-bounds read (CVE-ID: CVE-2026-64407)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in nxp_recv_fw_req_v3() in the btnxpuart Bluetooth driver when processing v3 firmware download requests from the controller. A local user can supply a controller that requests an offset or length beyond the firmware image to disclose sensitive information.

The issue occurs during firmware download over UART.

259) Use-after-free (CVE-ID: CVE-2026-64408)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in bnep_add_connection() during network device registration when handling a concurrent controller teardown. A local user can trigger a race condition to cause a denial of service.

260) Infinite loop (CVE-ID: CVE-2026-64409)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper loop termination in btmtksdio_txrx_work() when processing Bluetooth SDIO transmit and receive work. A local user can trigger repeated pending interrupt handling to cause a denial of service.

The issue can cause the workqueue to loop indefinitely and prevent release of the SDIO host.

261) Out-of-bounds read (CVE-ID: CVE-2026-64411)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in find_table_lock() table name handling when processing a user-supplied ebtables table name through setsockopt calls. A local user can supply a non-null-terminated table name to trigger a read past the end of the name buffer and disclose sensitive information.

The issue occurs on a lookup miss when module autoload formatting uses the supplied table name.

262) Improper input validation (CVE-ID: CVE-2026-64412)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the ebtables match handling code in net/bridge/netfilter/ebtables.c when processing a crafted module name. A local user can supply a non-null-terminated module name to cause a denial of service.

263) Improper Initialization (CVE-ID: CVE-2026-64413)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in the ebtables table translation logic in net/bridge/netfilter/ebtables.c when allocating and freeing the chainstack array. A local user can trigger an allocation failure during table translation to cause a denial of service.

The issue arises when a sparse cpu_possible_mask causes an uninitialized chainstack entry to be freed during cleanup.

264) NULL pointer dereference (CVE-ID: CVE-2026-64417)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in shrinker_debugfs_add() debugfs file handling when writing to a debugfs count or scan file for a shrinker with a missing callback. A local user can write to a crafted debugfs file associated with such a shrinker to cause a denial of service.

The issue can be triggered when a shrinker implements only one of the count_objects() or scan_objects() callbacks, such as the xen-backend shrinker example described in the advisory.

265) Race condition (CVE-ID: CVE-2026-64418)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition leading to use-after-free or double-free in shrinker_info teardown in mm/shrinker.c when handling memcg shrinker_info expansion and teardown during memory cgroup online and shrinker allocation operations. A local user can trigger concurrent memory cgroup and shrinker operations to cause a denial of service.

The issue occurs when a partially initialized or already published shrinker_info array remains visible to iteration during teardown.

266) Improper locking (CVE-ID: CVE-2026-64419)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in shrinker_debugfs_count_show() when reading the debugfs "count" file of a memcg-aware shrinker. A local user can read the debugfs file to cause a denial of service.

The issue occurs because a callback may sleep while executing inside an RCU read-side critical section.

267) Use-after-free (CVE-ID: CVE-2026-64420)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the cros_ec device probe handling in drivers/mfd/cros_ec_dev.c when sub-drivers access platform device drvdata after probe failure. A local user can trigger a failed probe and subsequent access to a stale pointer to cause a denial of service.

The issue occurs because the stale drvdata pointer remains accessible to sub-drivers such as cros_ec_typec after the underlying cros_ec_dev structure has already been released.

268) Use-after-free (CVE-ID: CVE-2026-64421)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in mxc_isi_remove() and the imx8-isi media cleanup path when removing the imx8_isi module. A local user can trigger module removal to cause a denial of service.

The issue occurs because media links are removed after the media entity pads they reference have already been freed.

269) Out-of-bounds read (CVE-ID: CVE-2026-64422)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in tcp_mtu_probe() when processing an invalid net.ipv4.tcp_reordering value during MTU probing. A local user can write a negative tcp_reordering value to trigger the out-of-bounds read and disclose sensitive information.

Exploitation requires tcp_mtu_probing to be set to 2.

270) Use-after-free (CVE-ID: CVE-2026-64423)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the IGMP multicast group handling in net/ipv4/igmp.c when destroying a device while concurrent RCU readers traverse the multicast hash table. A local user can trigger multicast group membership operations and concurrent network processing to cause a denial of service.

The issue occurs because multicast group entries can remain reachable through the device multicast hash table during RCU reclamation.

271) Use-after-free (CVE-ID: CVE-2026-64424)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in netpoll tx_work handling when shutting down netpoll while a pending TX worker runs in parallel with the cleanup path. A local user can trigger netpoll cleanup during concurrent worker execution to cause a denial of service.

The issue occurs because the queued worker can continue running after the associated netpoll data has been freed.

272) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-64425)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in io_worker_handle_work() in io_uring/io-wq.c when processing linked work items during io_uring worker exit handling. A local user can submit linked work and trigger ring closure to cause a denial of service.

Exploitation requires a race condition where worker exit begins after the first linked item has started but before the remaining linked items are processed.

273) Improper locking (CVE-ID: CVE-2026-64428)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock type selection in the sch irq startup path when starting up a requested irq on PREEMPT_RT systems. A local user can request a threaded irq that reaches sch_irq_unmask() and sch_irq_mask_unmask() to cause a denial of service.

The issue occurs because the path is not sleepable, but a regular spinlock_t becomes a sleeping lock on PREEMPT_RT.

274) Improper locking (CVE-ID: CVE-2026-64429)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in the Spreadtrum EIC GPIO interrupt controller driver when starting up a requested IRQ on PREEMPT_RT systems. A local user can request a threaded IRQ to trigger a sleeping lock in an invalid context to cause a denial of service.

The issue occurs because the callback can be reached from a non-sleepable irq_startup() path.

275) Race condition (CVE-ID: CVE-2026-64430)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource access in the ntb_epf_vec_isr interrupt handler in drivers/ntb/hw/epf/ntb_hw_epf.c when handling interrupts and deriving the vector number through pci_irq_vector() in hardirq context. A local user can trigger the vulnerable interrupt handling path to cause a denial of service.

The issue can result in "scheduling while atomic" kernel splats because pci_irq_vector() reaches code that takes a mutex in hardirq context.

276) Out-of-bounds write (CVE-ID: CVE-2026-64432)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in log_replay in fs/ntfs3/fslog.c when mounting a crafted NTFS image and replaying the $LogFile journal. A local user can provide a specially crafted NTFS image to cause a denial of service or execute arbitrary code.

The issue can be triggered at mount time during the analysis pass when LCNs from an action log record are copied into an existing Dirty Page Table entry, and integer underflow in the target VCN delta can drive the destination index past the allocated page_lcns array.

277) Use-after-free (CVE-ID: CVE-2026-64433)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in add_device_complete in net/bluetooth/mgmt.c when handling concurrent bluetooth management device add and remove operations. A local user can trigger concurrent MGMT requests to access freed memory and cause a denial of service.

The issue occurs because hci_conn_params_lookup() is used without holding the required device lock while the returned object is later dereferenced.

278) Use-after-free (CVE-ID: CVE-2026-64434)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the Bluetooth L2CAP channel timeout handler when processing an asynchronous channel timeout after the associated connection has been torn down. A local user can trigger a channel timeout race to cause a denial of service.

The issue arises because the timeout worker may access chan->conn after the underlying connection object has already been freed.

279) Race condition (CVE-ID: CVE-2026-64435)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a data race in audit_queue handling in kernel/audit.c when reading queue length concurrently with queue updates. A local user can trigger audit activity to cause a denial of service.

The issue affects multiple lockless readers of the audit queue length in the audit subsystem.

280) Use of Uninitialized Variable (CVE-ID: CVE-2026-64436)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use of uninitialized memory in pfkey_msg2xfrm_state() when processing a PF_KEY IPComp state and migrating it. A local user can add a crafted IPComp security association via PF_KEY and trigger migration to cause a denial of service.

The issue affects the PF_KEY path for IPComp states; the XFRM netlink path is not affected.

281) Use-after-free (CVE-ID: CVE-2026-64437)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to use-after-free in smb2_cancel() and deferred byte-range lock handling in ksmbd when processing an SMB2_CLOSE followed by an SMB2_CANCEL for the same AsyncId. A remote user can send crafted SMB requests to cause a denial of service.

Exploitation requires authentication to the SMB service and access to a locking handle associated with deferred work.

282) Use-after-free (CVE-ID: CVE-2026-64438)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the VF2PF response workqueue handling in the intel_qat SR-IOV implementation when processing VF2PF messages during SR-IOV teardown. A local user can trigger concurrent VF2PF work so that a queued or in-flight worker dereferences freed per-VF state to cause a denial of service.

The issue occurs because PF-side response work stores a raw pointer to per-VF state that may be freed by adf_disable_sriov() before queued work completes.

283) Out-of-bounds write (CVE-ID: CVE-2026-64440)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.2 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in HT_caps_handler() when parsing a crafted 802.11 association response frame. A remote attacker can send a malicious access point response with an oversized HT Capabilities information element to cause memory corruption.

The issue can write beyond the fixed 26-byte HT_cap array into adjacent fields of struct mlme_ext_info.

284) Out-of-bounds read (CVE-ID: CVE-2026-64441)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in IE and WPS attribute parsing functions in drivers/staging/rtl8723bs/core/rtw_ieee80211.c when parsing crafted information element buffers. A local user can provide a specially crafted buffer to disclose sensitive information.

The issue affects rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr().

285) Out-of-bounds read (CVE-ID: CVE-2026-64442)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in IE parsing loops in issue_assocreq() and join_cmd_hdl() when processing AP beacon and probe-response frames with a truncated final information element. A remote attacker can send a malicious AP beacon or probe-response frame with a truncated final information element to cause a denial of service.

The issue is triggered when the stored IE data ends with an element_id byte without a following length byte.

286) Out-of-bounds read (CVE-ID: CVE-2026-64443)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the update_beacon_info() IE parsing loop in rtl8723bs when parsing a crafted Beacon frame from a malicious access point. A remote attacker can send a specially crafted Beacon frame to disclose sensitive information.

The issue can be triggered when the last information element is truncated or when an information element declares a length that extends past the available frame data.

287) Out-of-bounds read (CVE-ID: CVE-2026-64444)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in OnAssocRsp() in the rtl8723bs driver when parsing a crafted association response frame. A remote attacker can send a specially crafted association response frame to disclose sensitive information.

The issue can be triggered by a malicious access point through a truncated information element in the frame.

288) Improper input validation (CVE-ID: CVE-2026-64445)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in OnAuth() when processing seq=3 shared-key authentication responses. A remote attacker can send a specially crafted authentication frame to cause a denial of service.

The issue is triggered when the Challenge Text information element length differs from the required 128 bytes.

289) Out-of-bounds read (CVE-ID: CVE-2026-64445)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in OnAuth() when processing crafted shared-key authentication frames. A remote attacker can send a specially crafted authentication frame to disclose sensitive information.

The issue occurs in the shared-key authentication path when the Privacy bit is set and the frame is too short to contain a valid WEP IV and ICV.

290) Heap-based buffer overflow (CVE-ID: CVE-2026-64446)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to a heap-based buffer overflow in rtw_cfg80211_set_wpa_ie() when handling a crafted WPA or WPA2 information element in a connect request via nl80211. A local user can send a specially crafted connect request to cause memory corruption.

The issue can overflow the 256-byte supplicant_ie buffer by one byte into the adjacent last_mic_err_time field.

291) Out-of-bounds read (CVE-ID: CVE-2026-64448)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in smb2_check_message() and subsequent SMB client protocol decoders when processing crafted SMB2 responses with a data area. A remote attacker can send a specially crafted SMB server response to disclose sensitive information.

The issue is reachable during NEGOTIATE and SESSION_SETUP before the session is established, including through the SPNEGO/negTokenInit and NTLMSSP challenge decoders when mounting against a non-conforming server.

292) Heap-based buffer overflow (CVE-ID: CVE-2026-64449)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in the SLAVE-path helpers buffer_to_user() and buffer_from_user() in drivers/staging/vme_user/vme_user.c when processing read and write operations with an offset and count that exceed the fixed kern_buf size. A local user can issue crafted read or write operations to cause a denial of service or execute arbitrary code.

The issue occurs when the configured slave window exceeds the 128 KiB kern_buf allocation.

293) Out-of-bounds read (CVE-ID: CVE-2026-64450)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the TIPC broadcast Gap ACK blocks handling in tipc_bcast_sync_rcv() when processing a crafted broadcast PROTOCOL/STATE_MSG. A remote attacker can send a specially crafted broadcast STATE_MSG with a malformed Gap ACK blocks record to cause a denial of service.

Exploitation requires a TIPC neighbour that has negotiated TIPC_GAP_ACK_BLOCK.

294) Use-after-free (CVE-ID: CVE-2026-64452)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in lowpan_nhc_do_uncompression() when processing a malformed 6LoWPAN packet on an error path. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue is caused by a race condition involving descriptor unregistration and access to nhc->name outside the protection of lowpan_nhc_lock, and it can be reached through the Bluetooth 6LoWPAN L2CAP receive path.

295) Improper locking (CVE-ID: CVE-2026-64454)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in the dwc3 gadget disconnect callback path when suspending the gadget. A local user can trigger a gadget disconnect during suspend to cause a denial of service.

The issue occurs because the disconnect callback may run in a non-sleepable context with IRQs disabled, which can trigger kernel lockdep warnings and sleeping-function-in-invalid-context failures.

296) Use-after-free (CVE-ID: CVE-2026-64455)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in chaoskey_release() in the chaoskey USB driver when closing the device file after the USB device has been unplugged. A local user can close the device file after device unplug to cause a denial of service.

The invalid access occurs in a debugging log statement after the usb_interface structure has already been deallocated.

297) Out-of-bounds read (CVE-ID: CVE-2026-64456)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the virtio-rng driver copy_data() function when processing device-reported used.len values from a virtio-rng backend. A remote attacker can provide a specially crafted length value to disclose sensitive information.

The issue can leak adjacent guest-kernel slab contents through the guest RNG and can also be observed directly via /dev/hwrng. No guest userspace interaction is required for the initial out-of-bounds read to occur.

298) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-64458)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or perform an out-of-bounds read.

The vulnerability exists due to improper handling of exceptional conditions in damon_hot_score() and damon_max_nr_accesses() when processing user-controlled DAMON monitoring intervals via sysfs. A local user can write zero or excessively large interval values to sysfs settings to cause a denial of service or perform an out-of-bounds read.

Exploitation requires sysfs write permission.

299) Improper resource shutdown or release (CVE-ID: CVE-2026-64461)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the MediaTek PCIe controller driver when enabling a port fails during setup. A local user can trigger a port initialization failure to cause a denial of service.

The issue occurs in the probe error path after IRQ domains have already been created for the port.

300) Use-after-free (CVE-ID: CVE-2026-64462)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a stale pointer in the altera pcie irq handler teardown logic in drivers/pci/controller/pcie-altera.c when handling a probe failure after irq setup. A local user can trigger a driver probe failure to cause a denial of service.

The issue occurs because the chained IRQ handler and INTx IRQ domain can remain configured after probe failure while the associated devm-managed host bridge storage is released.

301) Improper resource shutdown or release (CVE-ID: CVE-2026-64463)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the rt1711h_probe() TCPCI port registration handling in drivers/usb/typec/tcpm/tcpci_rt1711h.c when handling device probe failures after registering a TCPCI port. A local user can trigger a device probe failure after port registration to cause a denial of service.

The issue occurs because the TCPCI port is not unregistered when later probe steps fail.

302) Improper locking (CVE-ID: CVE-2026-64465)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in xhci_free_streams() when freeing USB stream resources during device disconnect. A local user can disconnect a USB device with active stream endpoints to cause a denial of service.

The issue is triggered because memory freeing may sleep while the code is executing in atomic context.

303) Use-after-free (CVE-ID: CVE-2026-64468)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in binder_free_transaction() when freeing binder transactions. A local user can trigger a race condition involving a binder transaction to cause a denial of service.

The issue occurs because the target process can be freed after its reference is read and before its inner lock is acquired.

304) Use-after-free (CVE-ID: CVE-2026-64469)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in binder_thread_release() when releasing binder threads while transactions are being freed in parallel. A local user can trigger concurrent binder transaction activity to cause a denial of service.

The issue is caused by a race condition involving transaction stack cleanup during thread exit and parallel process teardown.

305) Use-after-free (CVE-ID: CVE-2026-64470)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to use-after-free in the btusb probe path in drivers/bluetooth/btusb.c when handling probe failures after Marvell OOB wakeup configuration. A local user can trigger a device probe failure after TX URBs have been submitted to cause a use-after-free.

The issue occurs in the completion callback for submitted TX URBs.

306) Use-after-free (CVE-ID: CVE-2026-64471)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the btusb driver probe error handling in drivers/bluetooth/btusb.c when handling Bluetooth USB controller registration failures and subsequent interface disconnection. A local attacker can trigger controller registration failure to cause a denial of service.

The issue can also result in a double-free when the sibling interfaces are eventually disconnected.

307) Race condition (CVE-ID: CVE-2026-64472)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in vfio/mlx5 page tracker and device state flag handling when concurrently updating runtime bitfields. A local user can trigger concurrent device operations to cause a denial of service.

The issue affects flags that can be updated during runtime, including dirty tracking, reset handling, tracker error handling, and VF attach or detach event processing.

308) Use-after-free (CVE-ID: CVE-2026-64473)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in VFIO device debugfs entries when handling device unregister operations while userspace references remain open. A local user can keep references to the debugfs view during device teardown to cause a denial of service.

The issue affects diagnostic debugfs entries that may remain visible with stale inode private data during unregister.

309) Infinite loop (CVE-ID: CVE-2026-64474)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of an error sentinel in vfio_mig_get_next_state() when processing blocked VFIO migration state transitions. A local user can trigger a blocked transition on a precopy-capable device to cause a denial of service.

The issue can cause the loop to spin forever while holding the driver state mutex, resulting in a soft lockup and potentially a panic if softlockup_panic is set.

310) Use-after-free (CVE-ID: CVE-2026-64475)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the VGA arbiter callback handling in vfio_pci_core_register_device() when registration of a vfio PCI device fails after VGA arbiter client initialization. A local user can trigger device registration failure and leave a stale callback referencing freed device data to cause a denial of service.

The issue occurs on the error path and depends on a stale VGA arbiter registration remaining after the vfio device state has been freed.

311) Improper Initialization (CVE-ID: CVE-2026-64476)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in vfio-pci runtime power management handling when changing the disable_idle_d3 setting for devices already bound to vfio-pci variant drivers. A local user can change the sysfs module parameter and trigger unbalanced power management operations to cause a denial of service.

The issue occurs because the setting was latched globally at module initialization rather than consistently per device, creating a window where existing bound devices could operate with inconsistent power management behavior.

312) NULL pointer dereference (CVE-ID: CVE-2026-64478)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in snd_dualsense_ih_match() when handling repeated device disconnect and reconnect events. A local attacker can trigger a controller disconnect race to cause a denial of service.

The issue can occur when a weak physical connection causes rapid hotplug activity during USB device teardown.

313) Use of Uninitialized Variable (CVE-ID: CVE-2026-64479)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an uninitialized heap leak in snd_seq_event_dup() when delivering a legacy event to a UMP client with SNDRV_SEQ_FILTER_NO_CONVERT set. A local user can send a crafted event through /dev/snd/seq to disclose sensitive information.

The issue can leak 4 bytes of stale kernel heap data to user space, and exploitation requires a UMP-enabled build.

314) NULL pointer dereference (CVE-ID: CVE-2026-64480)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the ALSA ice1712 driver control creation logic when handling failed snd_ctl_new1() allocations. A local user can trigger memory allocation failure and reach code paths that dereference a NULL pointer to cause a denial of service.

315) Use-after-free (CVE-ID: CVE-2026-64481)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the cs35l41_hda firmware load work and ALSA control handling when a firmware load is requested and queued work executes after component unbind or device removal. A local user can trigger a firmware load request and remove the component or device before the queued work runs to cause a denial of service.

Exploitation requires firmware autostart to be disabled and can occur before DSP initialization.

316) NULL pointer dereference (CVE-ID: CVE-2026-64482)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in snd_gf1_pcm_volume_control() when handling a failed snd_ctl_new1() allocation. A local user can trigger a memory allocation failure leading to a NULL dereference to cause a denial of service.

317) Out-of-bounds write (CVE-ID: CVE-2026-64483)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service or execute arbitrary code.

The vulnerability exists due to an out-of-bounds read and out-of-bounds write in isight_packet() when processing crafted FireWire isochronous packets from a device on the bus during normal capture. An attacker with physical access can provide a malicious device that reports an oversized sample count to cause a denial of service or execute arbitrary code.

Exploitation requires a malicious or faulty Apple iSight device connected on the FireWire bus.

318) NULL pointer dereference (CVE-ID: CVE-2026-64484)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in snd_es1938_mixer() in sound/pci/es1938.c when handling mixer control initialization. A local user can trigger a memory allocation failure and reach the vulnerable code path to cause a denial of service.

319) NULL pointer dereference (CVE-ID: CVE-2026-64486)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in snd_cmipci_mixer_new in sound/pci/cmipci.c when handling control creation failures from snd_ctl_new1(). A local user can trigger a memory allocation failure and reach a NULL pointer dereference to cause a denial of service.

320) Out-of-bounds read (CVE-ID: CVE-2026-64487)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to out-of-bounds read in snd_usb_caiaq_tks4_dispatch() when parsing input from a crafted USB device input stream. An attacker with physical access can provide a malformed short final message block to cause a denial of service.

The issue is triggered because the device-controlled input length is not guaranteed to be a multiple of the 16-byte message block size, leading to an unsigned underflow during iteration.

321) NULL pointer dereference (CVE-ID: CVE-2026-64488)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in sound/aoa/fabrics/layout.c when handling control creation failures in layout_attached_codec(). A local user can trigger a memory allocation failure that leads to dereferencing a NULL control pointer to cause a denial of service.

322) NULL pointer dereference (CVE-ID: CVE-2026-64489)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in snd_ymfpci_create_spdif_controls() when handling control creation after memory allocation failure in snd_ctl_new1(). A local user can trigger memory allocation failure and reach the dereference of a NULL control pointer to cause a denial of service.

323) Improper resource shutdown or release (CVE-ID: CVE-2026-64493)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in mpl115_read_raw() in drivers/iio/pressure/mpl115.c when handling failed reads of processed pressure or raw temperature. A local user can trigger a read error to cause a denial of service.

The issue leaks a runtime PM reference on the error path and can prevent the device from autosuspending.

324) Improper resource shutdown or release (CVE-ID: CVE-2026-64494)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in gp2ap002_read_raw() when handling read errors from gp2ap002_get_lux(). A local user can trigger a read operation that causes an error to prevent the device from autosuspending and cause a denial of service.

The issue permanently leaks a runtime PM reference on the error path.

325) Out-of-bounds read (CVE-ID: CVE-2026-64495)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds read in bmg160_get_filter() and bmg160_set_filter() when handling sysfs input for the in_anglvel_filter_low_pass_3db_frequency interface. A local user can supply a value that is not present in bmg160_samp_freq_table to cause a denial of service.

The issue is reachable from userspace through the sysfs interface.

326) Out-of-bounds read (CVE-ID: CVE-2026-64496)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the iio event FIFO handling in drivers/iio/industrialio-event.c when reading from a newly created event file descriptor concurrently with FIFO reset. A local user can read from the file descriptor from another thread to disclose sensitive information.

Exploitation requires shared file descriptor table access between threads, creating a race window before the fd number is returned to userspace.

327) Integer overflow (CVE-ID: CVE-2026-64497)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect sensor data processing.

The vulnerability exists due to an integer sign-extension bug in the scd30_float_to_fp() function in the SCD30 IIO chemical sensor driver when converting floating-point sensor values. A local user can trigger the conversion of a crafted floating-point value to cause incorrect sensor data processing.

The issue affects the Linux kernel SCD30 sensor driver code path that converts device-provided floating-point values into fixed-point representation.

328) Improper Initialization (CVE-ID: CVE-2026-64500)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in lpc32xx_adc_probe() and the lpc32xx ADC interrupt handling path when handling a spurious interrupt during device probe before completion initialization. A local user can trigger a device state that causes an interrupt to arrive before init_completion() to cause a denial of service.

The issue can lead to a kernel panic through a NULL pointer dereference and resulting wild memory access in the interrupt wake-up path.

329) Improper resource shutdown or release (CVE-ID: CVE-2026-64503)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in kxsd9_write_raw() when handling write requests for scale values with a non-zero integer part. A local user can send a crafted write request to cause a denial of service.

The issue leaks a runtime PM usage-counter reference, which can prevent the device from autosuspending.

330) Stack-based buffer overflow (CVE-ID: CVE-2026-64504)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to execute arbitrary code or cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in __bmc150_accel_fifo_flush() when processing a device-reported FIFO frame count. An attacker with physical access can tamper with the I2C/SPI bus or use a malicious device that reports an oversized frame count to execute arbitrary code or cause a denial of service.

The issue can overwrite the stack canary, saved registers, and return address during FIFO data transfer.

331) Out-of-bounds read (CVE-ID: CVE-2026-64505)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in rndis_rm_hdr in the RNDIS USB gadget function when parsing a crafted RNDIS header. A local user can provide a truncated header to cause a denial of service.

332) Observable discrepancy (CVE-ID: CVE-2026-64507)

CWE-ID: CWE-203 - Observable discrepancy

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper protection against speculative execution in BPF JIT memory reuse on x86 systems when reusing JIT-compiled BPF memory under Spectre-v2 conditions. A local user can trigger BPF JIT allocation reuse to disclose sensitive information.

Only systems with BPF-JIT enabled are affected.

333) Protection mechanism failure (CVE-ID: CVE-2026-64508)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass branch prediction isolation for reused BPF JIT memory.

The vulnerability exists due to improper isolation of indirect branch predictor state in the BPF JIT allocator when reusing JIT memory for newly written programs. A remote attacker can load and free BPF programs to bypass branch prediction isolation for reused BPF JIT memory.

Allocations larger than a pack are not covered by this condition, and the described attack surface is limited to cBPF programs that fit within pack size constraints.

334) Use-after-free (CVE-ID: CVE-2026-64510)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the ACPI NFIT core when handling a subsequent ACPI Machine Check Exception after a failed or incomplete NFIT initialization and shutdown path. A local attacker can trigger the vulnerable initialization state to cause a denial of service.

The issue occurs because a freed acpi_desc object may remain referenced in the acpi_descs list and later be accessed by nfit_handle_mce().

335) NULL pointer dereference (CVE-ID: CVE-2026-64511)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in acpi_nfit_uc_error_notify() in the ACPI NFIT core when handling an NFIT_NOTIFY_UC_MEMORY_ERROR notification for an NFIT device without initialized driver data. An attacker with physical access can trigger a firmware notification to cause a denial of service.

The issue occurs when the notify handler is installed before the presence of the NFIT table is verified.

336) Improper input validation (CVE-ID: CVE-2026-64512)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the ACPI CPPC register width handling in drivers/acpi/cppc_acpi.c when processing ACPI PCC register definitions. A local attacker can provide a crafted access_width value to trigger a shift-out-of-bounds condition and cause a denial of service.

The issue occurs because the access_width field is reused as a PCC subspace identifier for ACPI_ADR_SPACE_PLATFORM_COMM entries.

337) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-64514)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of non-present page table entries in userfaultfd_must_wait() and userfaultfd_huge_must_wait() when checking writability during userfaultfd write-protect fault handling. A local user can trigger a fault involving a swap or migration entry to cause a denial of service.

In the worst case, the affected thread may remain asleep waiting for a wake event that never arrives.

338) Use-after-free (CVE-ID: CVE-2026-64530)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in tcf_qevent_handle in net/sched/cls_api.c when handling TC_ACT_CONSUMED during qevent processing of fragmented traffic. A local user can send specially crafted fragmented network traffic to trigger use of an skb after ownership has been transferred and cause a denial of service.

Exploitation requires RED qdisc qevents together with ct defragmentation and traffic that produces out-of-order fragments.

339) Out-of-bounds write (CVE-ID: CVE-2026-64532)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds write in do_action() in fs/ntfs3/fslog.c when processing a crafted on-disk NTFS index entry in UpdateRecordDataRoot or UpdateRecordDataAllocation. A local user can mount or otherwise supply a specially crafted NTFS image to trigger the out-of-bounds write and cause a denial of service.

The issue occurs because view.data_off and the resulting write length are not properly bounded against the NTFS_DE entry size.

340) Out-of-bounds read (CVE-ID: CVE-2026-64533)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in log_replay() in fs/ntfs3 when replaying a malformed NTFS filesystem restart table. A local user can provide a specially crafted filesystem image to cause a denial of service.

The issue occurs during conversion of DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY records for version 0 restart tables.

341) Use-after-free (CVE-ID: CVE-2026-64534)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in nvmet_tcp_try_recv_ddgst() when processing a command with a data digest mismatch after request initialization previously failed. A remote attacker can send a specially crafted request to cause a denial of service.

The issue can lead to a refcount underflow, kernel warnings, and a permanent workqueue deadlock.

342) Use-after-free (CVE-ID: CVE-2026-64535)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a use-after-free in the NVMe/TCP target digest error handling in nvmet_tcp_try_recv_ddgst() and queue teardown logic when processing a digest mismatch on a non-final H2C_DATA PDU during an R2T-based data transfer. A remote user can trigger a digest mismatch to cause a denial of service.

Exploitation requires data digest to be enabled on the NVMe/TCP connection.

343) Out-of-bounds read (CVE-ID: CVE-2026-64536)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in is_ap_in_tkip() in drivers/staging/rtl8723bs/core/rtw_wlan_util.c when parsing information elements from network data. A remote attacker can provide a truncated or crafted information element buffer to cause a denial of service.

344) Improper input validation (CVE-ID: CVE-2026-64537)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the bridge cfm ccm transmission logic when configuring an invalid ccm interval. A local user can set an invalid expiration interval to trigger a tight workqueue loop and exhaust memory to cause a denial of service.

The issue can result in immediate re-arming of delayed work and repeated skb allocations until out-of-memory conditions occur.

345) NULL pointer dereference (CVE-ID: CVE-2026-64538)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in fib6_nh_mtu_change() when processing router advertisement-driven MTU changes. A remote attacker can send a specially crafted ICMPv6 router advertisement to cause a denial of service.

The issue can occur during interface teardown when the IPv6 device pointer has been cleared while nexthop-backed routes are still being walked.

346) Stack-based buffer overflow (CVE-ID: CVE-2026-64539)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in eir_create_adv_data() in the Bluetooth EIR advertising data builder when constructing legacy advertising data for an LE-only controller. A local user can supply crafted advertising instance data to trigger a stack out-of-bounds write and cause a denial of service.

Exploitation requires CAP_NET_ADMIN and access to the legacy advertising path on an LE-only controller.

347) Out-of-bounds read (CVE-ID: CVE-2026-64540)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in genelink_rx_fixup() when processing device-supplied aggregated RX frames from a crafted GeneLink (GL620A) USB device. An attacker with physical access can provide a short URB with inconsistent packet length metadata to disclose sensitive information.

The issue can leak adjacent kernel heap contents to the network stack as soon as the USB network interface is up.

348) Use-after-free (CVE-ID: CVE-2026-64541)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in smc_cdc_rx_handler() when handling SMC-R CDC messages for a connection after releasing conns_lock. A local user can trigger a concurrent socket close while the handler continues to dereference the freed socket to cause a denial of service.

Only SMC-R is affected.

349) NULL pointer dereference (CVE-ID: CVE-2026-64542)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in accept_untracked_na() when handling IPv6 neighbor advertisement packets. A local user can trigger concurrent network namespace activity to cause a denial of service.

It is reachable by an unprivileged user via a network namespace.

350) Use-after-free (CVE-ID: CVE-2026-64543)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in tipc_disc_rcv() when processing TIPC discovery messages on a UDP bearer. A local user can trigger network namespace-accessible TIPC bearer operations and send crafted traffic to cause a denial of service.

Exploitation requires CONFIG_TIPC and CONFIG_TIPC_MEDIA_UDP. The affected functionality is reachable from an unprivileged user namespace because the TIPCv2 generic netlink family is netnsok and its bearer commands do not require GENL_ADMIN_PERM.

351) Out-of-bounds read (CVE-ID: CVE-2026-64544)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in pefile_digest_pe_contents when processing a crafted PE file. A local user can supply a specially crafted PE file to cause a denial of service.

The issue occurs because an unsigned subtraction can underflow after the trailing-data hash length calculation exceeds the PE length, which can lead to a kernel panic on unmapped vmalloc guard pages.

352) NULL pointer dereference (CVE-ID: CVE-2026-64545)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in xdp_master_redirect() when processing XDP_TX on a bond slave during upper-master unlinking. A local user can trigger packet processing in this race window to cause a denial of service.

The issue can lead to a kernel panic when the receiving device no longer has an upper-master adjacency but is still treated as a bond slave.

353) Out-of-bounds read (CVE-ID: CVE-2026-64546)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in drm_parse_tiled_block() when parsing a crafted DisplayID tiled-display block in EDID data. A local user can supply crafted EDID data with a truncated tiled-display block to disclose sensitive information.

The issue is triggered when the tiled-display block declares a small payload length near the end of a DisplayID extension.

354) Out-of-bounds read (CVE-ID: CVE-2026-64547)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in net1080_rx_fixup() when processing a crafted short frame from a malicious NetChip 1080 device. An attacker with physical access can send a frame advertising a large even packet length to cause a denial of service.

355) Integer overflow (CVE-ID: CVE-2026-64548)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow leading to an out-of-bounds write in bpf_msg_push_data() when processing a crafted len value in the copy fallback path. A local user can supply a crafted len value to cause a denial of service.

Exploitation requires access to BPF-driven sockmap message processing and occurs when the scatterlist ring is full or nearly full.

356) Out-of-bounds read (CVE-ID: CVE-2026-64549)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in bpa10x_setup() when processing a crafted device response to the vendor command. An attacker with physical access can return a one-byte or unterminated response to disclose sensitive information.

The out-of-bounds data may be exposed through the kernel log and the firmware-info debugfs file.

357) Out-of-bounds read (CVE-ID: CVE-2026-64550)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in rmnet_map_ingress_handler() and __rmnet_map_ingress_handler() when processing a crafted short MAP frame on the no-aggregation ingress path. A local user can send a specially crafted frame to disclose sensitive information.

The issue occurs when ingress deaggregation is disabled, causing packet parsing to use the on-wire packet length without verifying skb->len first.

358) Out-of-bounds read (CVE-ID: CVE-2026-64551)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized memory.

The vulnerability exists due to an out-of-bounds read in sctp_sf_do_5_2_6_stale() when processing an ERROR chunk with a STALE_COOKIE cause in the COOKIE_ECHOED state. A local user can send a specially crafted SCTP packet to disclose uninitialized memory.

The leaked value is echoed to the peer in the Cookie Preservative of the reply INIT. Exploitation is reachable by a peer that can drive an association into COOKIE_ECHOED, including an unprivileged process using a raw SCTP socket in a user and network namespace.

359) Out-of-bounds write (CVE-ID: CVE-2026-64552)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in receive_big() when processing a device-announced packet length from a virtio backend. A remote attacker can announce a specially crafted length value to cause memory corruption.

The issue can result in a NULL fragment being handed up the receive path.

360) Information disclosure (CVE-ID: CVE-2026-64553)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an information leak caused by improper clearing of padding bytes in PSAMPLE_ATTR_DATA handling in net/psample/psample.c when copying packet data into a netlink attribute. A local user can trigger processing of packet data whose length is not divisible by 4 bytes to disclose sensitive information.

The issue occurs because netlink attributes are padded to 4-byte boundaries.

361) Use-after-free (CVE-ID: CVE-2026-64554)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in br_ip6_fragment() when processing crafted IPv6 packets on a cloned skb. A local user can send a specially crafted packet to cause a denial of service.

The issue results from dereferencing a stale prevhdr pointer after skb_checksum_help() reallocates the skb head, and the resulting write can trigger a kernel panic.

362) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64555)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect hypervisor state handling.

The vulnerability exists due to improper state management in kvm_hyp_handle_mops() when handling a MOPS exception during nested virtualization. A local user can trigger this code path to cause incorrect hypervisor state handling.

The issue affects arm64 KVM in nested virtualization scenarios.

363) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64556)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to improper state management in perf_event_remove_on_exec() and event group handling in the perf subsystem when removing events marked remove_on_exec. A local user can trigger event removal for a group leader with surviving siblings to corrupt kernel memory.

The issue occurs when a removed event is a group leader and sibling events without remove_on_exec remain active in a stale group state.

364) Use-after-free (CVE-ID: CVE-2026-64557)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in l2cap_sock_new_connection_cb() in the Bluetooth L2CAP subsystem when handling a newly enqueued child socket reachable through the accept queue after the parent socket lock is released. A remote attacker can trigger a crafted Bluetooth L2CAP connection to execute arbitrary code.

The issue occurs because another task may accept and free the child socket before the callback dereferences it.

365) Use-after-free (CVE-ID: CVE-2026-64560)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in the posix CPU timers subsystem when handling a non-leader exec() race involving POSIX CPU timer deletion, setting, or rearming. A local user can trigger concurrent exec() and timer operations to execute arbitrary code.

The issue occurs when a TGID-targeted timer remains inherited across exec(), and can also cause user-visible transient -ESRCH errors or prevent timer rearming.

366) Improper Initialization (CVE-ID: CVE-2026-64561)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the KVM x86 shadow MMU page fault handling code when processing stale page faults after reclaiming shadow pages. A local user can trigger page faults that lead KVM to map memory into an invalid root to cause a denial of service.

The issue occurs when reclaiming shadow pages invalidates an in-use root, causing child shadow pages created during map or fetch operations to inherit an invalid role and violate the invariant that invalid shadow pages must not appear on the list of active MMU pages.

367) Use-after-free (CVE-ID: CVE-2026-64562)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in KVM nested VMX shadow VMCS handling when freeing nested virtualization state asynchronously with respect to loaded VMCS clearing during vCPU migration. A local user can trigger nested virtualization cleanup and vCPU migration to execute VMCLEAR on a freed shadow VMCS and cause a denial of service.

The issue occurs because vmcs01 may still reference the shadow VMCS until explicit VMCLEAR completes.

368) Use-after-free (CVE-ID: CVE-2026-64563)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in rhashtable_walk_next in the rhashtable iterator logic when resuming multi-fragment rhashtable walks across walk_stop and walk_start boundaries after a table restart. A local user can trigger a stale iterator pointer dereference to cause a denial of service.

Concrete affected call paths include netlink_diag and TIPC.

369) Use-after-free (CVE-ID: CVE-2026-64564)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in sctp_process_asconf_param() when processing crafted SCTP ASCONF DEL-IP parameters. A remote attacker can send a specially crafted SCTP ASCONF message to cause a denial of service.

The issue can occur when a single ASCONF carries DEL-IP parameters that free the cached transport and a later wildcard DEL-IP reuses the dangling transport pointer.

370) Heap-based buffer overflow (CVE-ID: CVE-2026-64565)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in ims_pcu_handle_response() when processing oversized packets from a malicious USB device. An attacker with physical access can send a specially crafted oversized USB packet to execute arbitrary code.

The issue arises because ims_pcu_process_data() does not properly bound-check read_pos, allowing it to be overwritten and later used as a controlled index during response handling.

371) Out-of-bounds read (CVE-ID: CVE-2026-64567)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in io_ctl_check_crc() in the btrfs free space cache loader when loading a corrupted v1 free space cache. A local user can modify free space cache header counts to exceed the number of allocated pages to cause a denial of service.

The invalid out-of-bounds slot is treated as a struct page and can lead to a general protection fault during crc32c() processing.

372) Double free (CVE-ID: CVE-2026-64568)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in ieee80211_set_unsol_bcast_probe_resp() when handling updates to unsolicited broadcast probe response templates after an allocation failure. A local user can trigger a later update or AP teardown to cause a denial of service.

The issue occurs because the pointer can still reference an object already queued for RCU freeing after kzalloc() fails.

373) NULL pointer dereference (CVE-ID: CVE-2026-64569)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in mpls_valid_fib_dump_req() when handling an RTM_GETROUTE dump request for AF_MPLS with strict checking and no RTA_OIF attribute. A local user can send a specially crafted netlink request to cause a denial of service.

The issue affects CONFIG_INET=n builds.

374) Double free (CVE-ID: CVE-2026-64570)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in ieee80211_set_fils_discovery() when handling FILS discovery template updates after an allocation failure. A local user can trigger an allocation failure and cause the same object to be queued for freeing multiple times to cause a denial of service.

The issue is triggered when a later update or AP teardown re-queues an object that still points to memory already scheduled for RCU freeing.

375) Out-of-bounds read (CVE-ID: CVE-2026-64571)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in p54_rx_eeprom_readback() when processing a device-supplied EEPROM readback frame. An attacker with physical access can send a truncated frame with a matching advertised length to disclose sensitive information.

The issue can be triggered by a malicious USB device.

376) Use-after-free (CVE-ID: CVE-2026-64572)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a use-after-free in fib_table_lookup() and the IPv4 FIB alias list handling in fib_trie.c when processing concurrent route insertion failure and lookup operations. A local privileged user can trigger a route insertion error path and perform a concurrent lookup to cause a denial of service.

Exploitation requires CAP_NET_ADMIN and a registered FIB notifier that can reject a route, such as when an IPv4 FIB resource is exhausted on a netdevsim device.

377) Integer underflow (CVE-ID: CVE-2026-64573)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read and out-of-bounds write in the qca_tlv_check_data() TLV parser when parsing a crafted firmware TLV with an undersized NVM tag length. A local user can supply a specially crafted firmware image to trigger out-of-bounds access and cause a denial of service.

The issue is caused by an integer underflow in the loop bound calculation for TLV_TYPE_NVM records.

378) Use-after-free (CVE-ID: CVE-2026-64574)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in ieee80211_if_read_link and related mac80211 link handling when reading debugfs link files after a vif link update error path leaves stale debugfs entries for newly added links. A local user can open and read a debugfs link file referencing freed memory to cause a denial of service.

The issue is triggered when drv_change_vif_links() fails after new links have been allocated and initialized.

379) Use of Uninitialized Variable (CVE-ID: CVE-2026-64576)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use of uninitialized memory in nh_res_bucket_migrate() when handling rtnetlink nexthop operations. A local user can send a specially crafted netlink message to cause a denial of service.

The issue can lead to a general protection fault and kernel panic when an error path dereferences an uninitialized extack message pointer.

380) Unchecked Return Value (CVE-ID: CVE-2026-64577)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of a failed buffer pull in gtp1u_send_echo_resp() in the Linux kernel GTP implementation when processing a crafted short echo request packet. A remote attacker can send a specially crafted packet to cause a kernel panic.

The issue is triggered by a 16 to 19 byte echo request that causes skb_pull_data() to fail while execution continues and skb data is moved below the buffer head.

381) Out-of-bounds read (CVE-ID: CVE-2026-64578)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ksmbd_smb2_check_message() when processing a crafted compound SMB2 request. A remote attacker can send a specially crafted compound request with a trailing element that is too small to hold StructureSize2 to disclose sensitive information.

The issue occurs when the last compound element contains only a 64-byte SMB2 header, causing a 2-byte read at offset 64 to extend past the receive buffer.

382) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64579)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in xfrm_hash_rebuild() in the xfrm policy subsystem when rebuilding policy hashes under memory pressure. A local user can trigger policy reinsertions that take the allocating inexact insertion path and cause a kernel crash.

The issue is reachable under memory pressure and can be triggered deterministically with failslab.

383) Double free (CVE-ID: CVE-2026-64580)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in xfrm6_fill_dst() when handling an error path after in6_dev_get(dev) returns NULL. A local user can trigger network operations that reach the affected code path to cause a denial of service.

The issue underflows a net_device reference count and can lead to kernel warnings while waiting for the device to become free.

384) Double free (CVE-ID: CVE-2026-64581)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in xfrm_user_policy() when racing a per-socket policy change with packet transmission on a connected UDP socket. A local user can trigger concurrent socket operations to cause a denial of service.

The issue is reachable by an unprivileged user via a user and network namespace.

385) Use-after-free (CVE-ID: CVE-2026-64582)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in rxe_mmap in the RDMA/rxe subsystem when processing a memory mapping request concurrently with a DESTROY_CQ ioctl. A local user can trigger a race condition to cause a denial of service or execute arbitrary code.

Exploitation requires winning a narrow race window between the mmap path and concurrent object destruction.

386) Use-after-free (CVE-ID: CVE-2026-64583)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the Broadcom BDC USB gadget UDC driver IRQ handler and delayed work processing when tearing down the driver during device removal. A local user can trigger a shared interrupt or delayed work execution during teardown to cause a denial of service.

The issue occurs in the window after teardown of endpoint and DMA-related structures begins while the IRQ handler remains deliverable, and delayed work may also execute after removal.

387) Use-after-free (CVE-ID: CVE-2026-64584)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the f_midi driver work handler when handling concurrent userspace writes to an open rawmidi substream during device teardown. A local user can write to a rawmidi substream to trigger pending work on a freed midi object and cause a denial of service.

The issue occurs because the rawmidi device can remain usable by an open substream after USB endpoints have been disabled and before the final midi object reference is released.

388) Use-after-free (CVE-ID: CVE-2026-64585)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in esd_usb_disconnect() and unlink_all_urbs() when handling USB device disconnect events. A local user can trigger a device disconnect condition to cause a denial of service.

The issue occurs because per-netdev private data embedded in the net_device allocation is dereferenced after free during teardown.

389) Use-after-free (CVE-ID: CVE-2026-64586)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the brcmfmac bus_reset work handling when a reset is scheduled during device removal. A local user can trigger a bus reset through the debugfs "reset" entry to cause a denial of service.

The issue affects shared bus_reset work across PCIe, SDIO, and USB removal paths, and brcmf_fw_crashed() could also be triggered before driver attachment completed.

390) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-64590)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of overlapping dma mappings in udmabuf scatter-gather table mapping when importing a udmabuf into a DRM driver with DMA API debug enabled. A local user can import a udmabuf to trigger a kernel warning to cause a denial of service.

The issue is observed when CONFIG_DMA_API_DEBUG_SG is enabled.

391) NULL pointer dereference (CVE-ID: CVE-2026-64593)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in btrfs_trim_free_extents in the Btrfs filesystem when processing a FITRIM ioctl on a rescanned device that is not writeable. A local user can issue a trim request to trigger a kernel crash and cause a denial of service.

The issue occurs when a previously missing device is rescanned, clearing the missing-device state while the block device pointer remains NULL.

392) Improper Initialization (CVE-ID: CVE-2026-64594)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in reset_work handling in the functionfs gadget subsystem when unmounting a functionfs instance. A local user can unmount a crafted or affected functionfs instance to cause a denial of service.

The issue is triggered in the common case where the instance was never deactivated, including when it is not mounted with the "no_disconnect" option.

393) Double free (CVE-ID: CVE-2026-64597)

CWE-ID: CWE-415 - Double Free

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to double free in SMB2_close() in the SMB client close request handling when processing a response-bearing attempt that returns a replayable error. A remote user can trigger a replay sequence that causes the same response buffer to be freed twice to cause a denial of service.

394) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-64598)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of an error pointer in smb2_aead_req_alloc() when processing SMB client requests. A local user can trigger the bug to cause a denial of service.

395) Double free (CVE-ID: CVE-2026-64599)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in meson_crypto_probe() when handling a failure after partial channel list allocation during device probe. A local user can trigger the vulnerable probe path to cause a denial of service.

The issue was reproduced by forcing the second dma_alloc_attrs() call in the gxl-crypto probe path to fail after partial initialization.

396) Race condition (CVE-ID: CVE-2026-64600)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in xfs_reflink_fill_cow_hole and xfs_reflink_fill_delalloc in the XFS reflink code when processing direct I/O writes after cycling the ILOCK. A local user can trigger a racing direct I/O write operation to cause a denial of service.

The issue occurs because a stale data fork mapping can be used after the ILOCK is dropped and reacquired, which can result in incorrect shared-block state during copy-on-write handling.

397) Access of Uninitialized Pointer (CVE-ID: CVE-2026-64602)

CWE-ID: CWE-824 - Access of Uninitialized Pointer

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an uninitialized pointer dereference in the spear_adc_probe() initialization path and interrupt handler in drivers/iio/adc/spear_adc.c when handling a device interrupt before completion initialization. A local user can trigger a spurious interrupt during device probe to cause a denial of service.

The issue can lead to a kernel panic and was observed as a KASAN wild-memory-access caused by complete() operating on an uninitialized completion object.

398) Race condition (CVE-ID: CVE-2026-64603)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the intel-hid ACPI notify_handler() when handling concurrent tablet-mode events on multiple CPU cores. A local user can trigger concurrent notify events to cause a denial of service.

The issue affects convertible and detachable systems matched by DMI chassis types 31 and 32 where the SW_TABLET_MODE input device is registered lazily on the first tablet-mode event.

399) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-64604)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state handling in vmx_update_cr8_intercept when creating a vCPU outside guest mode. A local user can issue crafted KVM vCPU creation operations to cause a denial of service.

The issue can trigger a kernel warning due to calling get_vmcs12() when the vCPU is not in guest mode.

400) Out-of-bounds read (CVE-ID: CVE-2026-68082)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in decode_lockers() in net/ceph/cls_lock_client.c when parsing OSD-supplied lock information. A remote user can send a specially crafted OSD reply to disclose sensitive information.

Exploitation requires control of a malicious or compromised OSD and can be triggered against kernel clients that issue the lock.get_info class method, such as during RBD exclusive lock acquisition in a multi-tenant Ceph deployment.

401) Path traversal (CVE-ID: CVE-2026-68083)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to access files outside the exported share.

The vulnerability exists due to improper limitation of a pathname to a restricted directory in ksmbd_vfs_kern_path_create() when handling SMB create, mkdir, or hardlink operations with crafted path components. A remote user can race a missing path component and use a ".." path element to access files outside the exported share.

Exploitation requires authentication to the SMB service and a race condition between the rooted lookup and the create path resolution.

402) Improper resource shutdown or release (CVE-ID: CVE-2026-68084)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the tsi148_remove() function in the vme_user tsi148 bridge driver when unbinding the device or unloading the module. A local user can trigger device removal operations to cause a denial of service.

403) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68085)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the hci_uart Bluetooth line discipline write_work handling when closing and reopening the device. A local user can repeatedly reopen the device to cause a denial of service.

The issue can block future writes after the device is reopened if write_work was pending.

404) Out-of-bounds read (CVE-ID: CVE-2026-68088)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in rndis_query_response() in the RNDIS USB gadget function when processing a crafted RNDIS query message. A remote attacker can send a specially crafted RNDIS query message to cause a denial of service.

405) Race condition (CVE-ID: CVE-2026-68090)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in debugobjects in lib/debugobjects.c when handling object activation or initialization assertions during a concurrent out-of-memory disable. A local user can trigger debug object operations while forcing a concurrent memory exhaustion condition to cause a denial of service.

The issue can cause a valid timer object to become nonfunctional through an unintended fixup path.

406) Improper resource shutdown or release (CVE-ID: CVE-2026-68091)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in wacom_parse_and_register() in the Wacom HID driver when handling post-start probe failures. A local user can trigger a device initialization failure after HID hardware has been started to cause a denial of service.

407) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68093)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource lifecycle management in KVM SVM ASID handling when resuming a vCPU after a CPU hotplug cycle. A local user can trigger CPU hotplug conditions and resume execution of a affected vCPU to cause a denial of service.

The issue can result in ASID collisions between vCPUs from different VMs, causing stale TLB translations and KVM internal emulation failures.

408) Deadlock (CVE-ID: CVE-2026-68096)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a recursive locking deadlock in audit_dupe_exe() in the Linux kernel audit subsystem when handling file move events for executable audit rules. A local user can move a file that matches an existing executable audit rule to cause a denial of service.

Exploitation requires an existing executable audit rule that matches the file being moved.

409) Out-of-bounds read (CVE-ID: CVE-2026-68097)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in set_ntacl_dacl() in ksmbd when processing crafted ACE data in NT ACLs. A remote user can supply an undersized ACE with a SID sub-authority count that exceeds the declared ACE size to cause a denial of service.

The out-of-bounds access occurs later during the POSIX ACL deduplication walk after the malformed ACE has been copied.

410) Out-of-bounds read (CVE-ID: CVE-2026-68098)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in set_posix_acl_entries_dacl() in ksmbd when processing a DACL whose ACE copying stops early because size accounting overflows. A local user can provide a crafted DACL that causes the dedup walk to scan past the copied ACE array and disclose sensitive information.

The issue occurs because the dedup walk is bounded by the original NT ACE count rather than the number of ACEs actually copied into the rebuilt DACL.

411) Integer overflow (CVE-ID: CVE-2026-68099)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer overflow leading to out-of-bounds reads in ksmbd DACL builders when processing ACL entries. A remote attacker can send data that causes malformed ACL construction to cause a denial of service.

The issue occurs because an overflowed size value is consumed after loop termination, causing the committed NT ACL to under-report the bytes written and become malformed when re-parsed by clients or ksmbd itself.

412) Out-of-bounds read (CVE-ID: CVE-2026-68100)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in set_ntacl_dacl() when processing a crafted security descriptor during SMB2_QUERY_INFO(SecInfo=DACL). A remote user can send a crafted SMB2_SET_INFO request containing a malformed ACE and later trigger SMB2_QUERY_INFO to disclose sensitive information.

The issue affects inodes carrying a POSIX access ACL, and the malformed security descriptor is stored raw after being accepted because parse_dacl() breaks on a bad ACE instead of returning an error.

413) Use-after-free (CVE-ID: CVE-2026-68104)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the amdgpu ACP power management domain cleanup logic when removing the ACP power domain. A local user can trigger the affected cleanup path to cause a denial of service.

414) Division by zero (CVE-ID: CVE-2026-68106)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to division by zero in the amdgpu UVD H264 and H264 Perf decode paths when processing crafted frame dimensions with a width or height less than 16. A local user can submit crafted decoding parameters to cause a denial of service.

415) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-68107)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a time-of-check time-of-use race condition in the amdgpu vcn_v4_0 command submission handling in drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c when processing an indirect buffer. A local user can modify the indirect buffer between reads to cause a denial of service.

The issue affects the VCN4 encoding parameter parsing path.

416) Integer overflow (CVE-ID: CVE-2026-68108)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause out-of-bounds memory access.

The vulnerability exists due to integer overflow in amdgpu_vce_ring_parse_cs() in the VCE command stream parser when processing crafted VCE command streams with oversized image dimensions. A local user can submit a specially crafted command stream to cause out-of-bounds memory access.

The issue occurs when image dimensions wrap the calculated buffer size and bypass validation before reaching the GPU firmware.

417) Reachable assertion (CVE-ID: CVE-2026-68110)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a reachable assertion in sdma_v4_4_2_ring_emit_fence() in the amdgpu SDMA 4.4.2 driver when emitting fence commands. A local user can trigger the assertion condition to cause a denial of service.

418) Improper handling of exceptional conditions (CVE-ID: CVE-2026-68111)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in the amdgpu gfx_v9_0 driver when processing misaligned GPU buffer or address values. A local user can trigger BUG_ON() assertions with crafted alignment-related values to cause a denial of service.

The issue results in a kernel crash instead of a warning when alignment checks fail.

419) Reachable assertion (CVE-ID: CVE-2026-68112)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of assertion checks in gfx_v9_4_3.c when processing misaligned GPU addresses in amdgpu ring operations. A local user can trigger a BUG_ON condition to cause a denial of service.

420) Improper handling of exceptional conditions (CVE-ID: CVE-2026-68115)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in the amdgpu gfx_v10 code when processing misaligned GPU addresses. A local user can trigger a BUG_ON condition to cause a denial of service.

421) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68116)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass intended traffic filtering.

The vulnerability exists due to improper state management in vxlan multicast database remote source list handling when replacing the source list of an existing (*, G) remote entry. A local user can trigger a failed source list replacement to bypass intended traffic filtering.

An EXCLUDE filter may start forwarding traffic that should be blocked, while an INCLUDE filter may drop traffic that should be forwarded.

422) Use-after-free (CVE-ID: CVE-2026-68117)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in tipc_sk_create() and tipc_release() in the TIPC socket handling code when handling a failed accept() path after socket insertion failure. A local user can trigger creation of a large number of TIPC sockets and invoke accept() to cause a denial of service.

The issue is reached when the per-netns TIPC socket rhashtable hits its maximum size, leaving a pre-allocated child socket with a dangling sock->sk pointer during release.

423) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-68118)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of reset packets in tcp_check_req() when processing in-window RST segments in the SYN-RECEIVED request-socket path. A remote attacker can send a specially crafted non-exact RST packet to cause a denial of service.

The issue affects connection handling before a connection is fully established.

424) Use of uninitialized resource (CVE-ID: CVE-2026-68119)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to uninitialized memory in standalone TCP-AO response handling in tcp_v4_send_ack() and tcp_v6_send_response() when processing TCP responses with TCP-AO options whose MAC length is not four-byte aligned. A remote attacker can send packets that trigger standalone TCP responses to disclose sensitive information.

Only the one to three alignment padding bytes after the TCP-AO MAC are exposed, and the issue affects both IPv4 and IPv6 response paths.

425) Use-after-free (CVE-ID: CVE-2026-68121)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to a use-after-free in pppoe_sendmsg() when handling a blocked send while a non-Ethernet port is added to an empty team device. A local user can trigger skb head reallocation and subsequent writes through a stale PPPoE header pointer to cause memory corruption.

The issue occurs because device header callbacks may reallocate the skb head and invalidate saved pointers into it.

426) Integer underflow (CVE-ID: CVE-2026-68123)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer underflow in queue_userspace_packet() in the openvswitch subsystem when processing userspace actions on segmented gso packets after truncation. A local user can send a specially crafted packet that triggers truncation and segmentation handling to cause a denial of service.

The issue occurs because truncation state is reused across smaller gso segments, allowing the preserved length value to exceed the current packet length.

427) Out-of-bounds write (CVE-ID: CVE-2026-68124)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to perform out-of-bounds heap writes.

The vulnerability exists due to an out-of-bounds write in the MCTP serial receive state machine in drivers/net/mctp/mctp-serial.c when processing a zero-length MCTP serial frame. A local privileged user can send a specially crafted zero-length frame followed by data bytes to perform out-of-bounds heap writes.

Exploitation requires attaching the N_MCTP line discipline and bringing the resulting mctpserial network device up before sending bytes through the tty receive path.

428) Out-of-bounds read (CVE-ID: CVE-2026-68125)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in llsec_do_decrypt_auth() when processing crafted IEEE 802.15.4 secured frames with payloads shorter than the authentication tag. A remote attacker can send a specially crafted frame to cause a denial of service.

The crafted frame can reach the vulnerable path from an IEEE 802.15.4 peer in radio range.

429) Use-after-free (CVE-ID: CVE-2026-68126)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in mac802154_scan_worker() when racing scan requests against interface deletion or PHY removal. A local user can trigger a scan while concurrently deleting the interface to cause a denial of service.

The issue is reachable by racing TRIGGER_SCAN against DEL_INTERFACE.

430) Use-after-free (CVE-ID: CVE-2026-68127)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a use-after-free.

The vulnerability exists due to use-after-free in ila_update_ipv6_locator() and ila_csum_adjust_transport() when processing a crafted IPv6 packet routed through a configured ILA checksum-adjust-transport route or receive-side mapping. A remote attacker can send a specially crafted IPv6 packet to trigger a use-after-free.

Exploitation requires a configured ILA checksum-adjust-transport route or receive-side mapping.

431) Resource exhaustion (CVE-ID: CVE-2026-68129)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource handling in the gve Rx queue handling logic when processing received packets under extreme memory pressure. A local user can trigger page allocation failures that leave too few descriptors posted to hardware to cause a denial of service.

The issue can result in a permanent Rx queue stall because no receive completions are generated, preventing NAPI from being scheduled again.

432) Improper access control (CVE-ID: CVE-2026-68130)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper access control in ntlm_authenticate() when processing an NTLM authentication request containing a crafted username field and PreviousSessionId. A remote user can supply a username matching a victim account and a victim session identifier to cause a denial of service.

The issue can destroy another user's SMB session before the NTLMv2 response is validated.

433) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-68131)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of positive result codes in drivers/block/rbd.c when processing a corrupted reply to an object map update request. A remote attacker can send a corrupted reply to trigger an assertion and cause a denial of service.

The issue is triggered in the RBD object map update path for write requests.

434) Deadlock (CVE-ID: CVE-2026-68132)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock in the emergency thaw worker in fs/super.c when thawing frozen block devices. A local user can trigger emergency thaw handling to cause a denial of service.

The issue can deadlock against itself while reacquiring s_umount and can block subsequent unmount, freeze, or thaw operations for the affected filesystem and block device.

435) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-68135)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a resource leak in the hip04_rx_poll() receive path when handling a build_skb() failure. A local user can trigger build_skb() failures to cause a denial of service.

The issue leaks an RX buffer and its DMA mapping when slot references are overwritten, and also involves a newly allocated RX fragment if dma_map_single() fails.

436) Improper input validation (CVE-ID: CVE-2026-68136)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state validation in skb_gro_receive_list() in the GRO subsystem when processing flush-marked aggregated packets. A remote attacker can send specially crafted network traffic to cause a denial of service.

The issue can corrupt the frag_list chain and later trigger a kernel panic when skb_segment() processes the malformed packet state.

437) Use-after-free (CVE-ID: CVE-2026-68137)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in x25_kill_by_neigh() when handling termination of an X.25 neighbour while walking the global X.25 socket list. A local user can trigger concurrent socket release and neighbour teardown operations to cause a denial of service.

The issue is triggered by a race condition after the list lock is dropped and before the socket lifetime is pinned.

438) Race condition (CVE-ID: CVE-2026-68138)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition leading to use-after-free and double-free in qdisc_get_rtab() and qdisc_put_rtab() when processing concurrent RTM_NEWTFILTER requests that add flower filters with a police action carrying the same rate. A local user can send concurrent netlink filter configuration requests to cause a denial of service.

The corrupted qdisc_rate_table object is shared system-wide because the affected rate-table list is process-global rather than per-network-namespace.

439) NULL pointer dereference (CVE-ID: CVE-2026-68139)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in mlx5e_devcom_event_mpv in the Linux kernel mlx5 mlx5e multiport devcom handling when replaying affiliation events during PCI error recovery. A local user can trigger a crafted device recovery sequence to cause a denial of service.

The issue occurs because peer private data can become visible before the corresponding devcom backpointer is initialized, allowing a master-up event to reach a peer with a NULL devcom pointer.

440) Use-after-free (CVE-ID: CVE-2026-68140)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the af_iucv message queue handling when processing queued message notifications after a connection is severed. A local user can trigger connection severing with queued notifications still pending and then invoke recvmsg() to cause a denial of service.

The issue occurs because queued notifications retain stale references to a freed iucv_path.

441) NULL pointer dereference (CVE-ID: CVE-2026-68141)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in afiucv_hs_callback_syn() when handling connection requests that enter the connection-refused path after child socket allocation fails. A local user can trigger this condition to cause a denial of service.

The issue occurs because the code calls iucv_sock_kill() with a NULL child socket pointer.

442) Improper access control (CVE-ID: CVE-2026-68142)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify Geneve tunnel device configuration in another network namespace.

The vulnerability exists due to improper access control in geneve_changelink() when handling rtnetlink changelink requests for a Geneve device whose underlay network namespace differs from the device network namespace. A local privileged user can send a specially crafted changelink request to modify Geneve tunnel settings in the underlay network namespace.

The issue arises when the Geneve device has been created in or moved to a different network namespace than the one associated with its underlay sockets.

443) Race condition (CVE-ID: CVE-2026-68143)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to an out-of-bounds write and use-after-free in slip_receive_buf() and sl_realloc_bufs() when processing received SLIP data during a concurrent MTU change. A local user can trigger receive processing while racing an MTU change to cause a denial of service or execute arbitrary code.

444) Use-after-free (CVE-ID: CVE-2026-68144)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in pep_get_sb() when processing Phonet socket buffer data. A remote attacker can send a specially crafted network packet to cause a denial of service.

445) Out-of-bounds write (CVE-ID: CVE-2026-68145)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in ifs_set_range_dirty() when processing a zero-length range. A local user can trigger a user buffer fault that results in copied == 0 during a write operation to cause a denial of service.

The issue is reachable from __iomap_write_end() when copy_folio_from_iter_atomic() returns 0 and the folio is already uptodate.

446) Race condition (CVE-ID: CVE-2026-68146)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the ftrace trace_parser handling in ftrace_regex_write(), ftrace_graph_write(), ftrace_regex_release(), and ftrace_graph_release() when processing concurrent writes and release operations on a shared trace file descriptor. A local user can issue concurrent operations from multiple threads to cause a denial of service.

The issue occurs when a userspace process shares an opened trace file descriptor across multiple threads, causing corruption of the parser's internal state fields.

447) Use-after-free (CVE-ID: CVE-2026-68147)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to a use-after-free in fscrypt_destroy_inline_crypt_key() and fscrypt_get_devices() in fs/crypto/inline_crypt.c when evicting inline encryption keys for filesystem block devices. A local user can trigger key eviction during inode eviction under direct reclaim to cause a use-after-free.

The issue occurs when dynamic allocation of the block-device array fails, causing key memory to be freed without first evicting the key from all associated block devices.

448) Use-after-free (CVE-ID: CVE-2026-68148)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to a use-after-free in find_or_insert_direct_key() when reusing cached direct keys for inodes from different super_blocks. A local user can cause different super_blocks to reference the same cached direct key to cause a use-after-free.

The issue affects the legacy fscrypt_direct_keys table used by v1 encryption policies with FSCRYPT_POLICY_FLAG_DIRECT_KEY, while the v2 policy equivalent is not affected.

449) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68149)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass intended ACL handling and retain stale access control list data.

The vulnerability exists due to improper cache state handling in posix ACL caching for fuse inodes in the Linux kernel when invalidating cached ACL entries. A local user can trigger ACL updates and cache invalidation conditions to bypass intended ACL handling and retain stale access control list data.

The issue affects fuse filesystems that opt out of POSIX ACL caching when the fuse server does not negotiate POSIX ACL support.

450) Improper resource shutdown or release (CVE-ID: CVE-2026-68151)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the binfmt_elf_fdpic PT_INTERP program header handling when processing a crafted FDPIC ELF binary. A local user can execute a specially crafted binary to cause a denial of service.

The issue can be triggered repeatedly, and the affected file may remain unwritable for as long as the system runs.

451) Use-after-free (CVE-ID: CVE-2026-68153)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the monmap debugfs file handler when processing a concurrent read during client teardown. A local user can read the monmap debugfs file during teardown to cause a denial of service.

The issue is triggered by a race condition between debugfs access and ceph client teardown.

452) Out-of-bounds read (CVE-ID: CVE-2026-68154)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in crush_decode and the CRUSH mapper when parsing a malformed CRUSH map. A local user can supply a crafted CRUSH map with a zero bucket type to cause a denial of service.

The issue arises because bucket type 0 is reserved for devices, and an invalid map can make the mapper treat a negative bucket ID as a device and index the OSD weight array with a negative value.

453) Improper input validation (CVE-ID: CVE-2026-68155)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in ceph_monmap_decode() when processing a CEPH_MSG_MON_MAP monmap message. A remote attacker can send a specially crafted monmap advertising zero monitors to cause a denial of service.

The issue is triggered when the client later attempts to open a session with a monitor, causing an assertion in pick_new_mon() to fire.

454) Use-after-free (CVE-ID: CVE-2026-68156)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Ceph authorizer handling code when processing a rebuilt authorizer during a messenger reconnect. A local user can trigger an authorizer update that reallocates the buffer and then cause a reconnect to use a stale pointer to cause a denial of service.

The issue is triggered when a newer service ticket causes the authorizer to be rebuilt and the rebuilt authorizer no longer fits in the existing buffer.

455) NULL pointer dereference (CVE-ID: CVE-2026-68157)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in get_immediate_parent() in net/ceph/osdmap.c when processing malformed CRUSH hierarchy metadata during localized read selection. A local user can trigger lookup of a parent bucket whose type has no matching entry in type_names to cause a denial of service.

The issue occurs when a parent bucket name exists in the CRUSH map but its type name metadata is missing, causing an invalid pointer to be passed to strcmp().

456) Integer overflow (CVE-ID: CVE-2026-68158)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an integer overflow in decode_new_up_state_weight() when processing a corrupted CEPH_MSG_OSD_MAP message containing a crafted osdmap. A remote attacker can send a specially crafted message to disclose sensitive information.

The issue can lead to out-of-bounds reads while decoding the new_state portion of the osdmap.

457) Out-of-bounds write (CVE-ID: CVE-2026-68159)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a stack out-of-bounds write in __decode_pg_temp(), __decode_pg_upmap_items(), and OSDMap handling in net/ceph/osdmap.c when processing a crafted OSDMap containing an oversized pg_temp, pg_upmap, or pg_upmap_items entry. A remote attacker can send a specially crafted OSDMap entry to cause a denial of service.

The issue is triggered when the decoded list is later copied into the fixed-size on-stack array struct ceph_osds.osds[CEPH_PG_MAX_SIZE].

458) Out-of-bounds read (CVE-ID: CVE-2026-68160)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ceph_handle_caps() and ceph_update_snap_trace() when processing a crafted Ceph MDS caps message with a malicious snap_trace_len value. A remote attacker can send a specially crafted message to disclose sensitive information.

Exploitation requires a malicious or compromised MDS to send a version 1 message so the IMPORT path is reached without prior version-gated validation of snap_trace_len.

459) Improper resource shutdown or release (CVE-ID: CVE-2026-68161)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in SCTP UDP tunnel sockets during net namespace teardown when tearing down a network namespace with SCTP UDP tunneling enabled. A local user can trigger namespace teardown while the sockets remain installed to cause a denial of service.

Only systems using per-network-namespace SCTP UDP tunneling are affected.

460) Use-after-free (CVE-ID: CVE-2026-68162)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the SCTP auth_enable sysctl handler when handling writes to an already opened sysctl file during network namespace teardown. A local user can write to the auth_enable sysctl entry to cause a denial of service.

The issue is exposed during initialization before the SCTP control socket exists and during teardown after the control socket has been released.

461) Improper input validation (CVE-ID: CVE-2026-68164)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in damon_set_regions() when processing overlapping input ranges. A local user can provide overlapping or invalid address ranges to trigger a division by zero and cause a denial of service.

The issue can also lead to unexpected DAMON and DAMOS behavior, including malformed monitoring results and repeated application of actions to overlapping regions.

462) Improper input validation (CVE-ID: CVE-2026-68165)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in damon_set_regions() when processing user-supplied DAMON monitoring target regions. A local user can provide empty regions with equal start and end values to cause a denial of service.

The issue can trigger WARN_ONCE() on kernels built with CONFIG_DAMON_DEBUG_SANITY enabled, and can also lead to a divide-by-zero in damon_merge_two_regions().

463) Improper access control (CVE-ID: CVE-2026-68166)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to inject chosen return addresses.

The vulnerability exists due to improper access control in userfaultfd registration for virtual memory areas when registering shadow stack or special VMAs. A local user can register a shadow stack VMA with userfaultfd and inject a page with chosen return addresses via UFFDIO_COPY to inject chosen return addresses.

The issue involves shadow stack VMAs, and special VMAs are also affected in cases where a driver implements vm_uffd_ops.

464) Use-after-free (CVE-ID: CVE-2026-68169)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in mptcp_userspace_pm_get_local_id() in the MPTCP userspace path manager when processing overlapping MP_JOIN SYN and MPTCP_PM_CMD_SUBFLOW_DESTROY operations. A local user can trigger a race condition to cause a denial of service.

The race window is narrow and was reproduced with a locally constructed stress test.

465) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-68175)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a resource leak in the mmiotrace tracer trace_pipe handling when closing the trace_pipe file with the mmiotrace tracer active. A local user can repeatedly open and close trace_pipe to cause a denial of service.

If the trace_pipe is read to completion, the resources are cleaned up; repeated partial reads such as reading a single line can trigger a large leak.

466) NULL pointer dereference (CVE-ID: CVE-2026-68176)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the mmiotrace read() function when reading mmiotrace data after mmio_pipe_open() fails to find a PCI device. A local user can trigger the vulnerable read path to cause a denial of service.

467) Use-after-free (CVE-ID: CVE-2026-68178)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute code in kernel context.

The vulnerability exists due to use-after-free in the NSM misc device file operations handling in /dev/nsm when invoking ioctl on an open file descriptor after the nsm module has been unloaded. A local user can open /dev/nsm, keep the file descriptor open, and later issue an ioctl after module removal to execute code in kernel context.

The issue is exposed when the driver is built as a module and an open /dev/nsm file descriptor outlives removal of the module that provides the ioctl callbacks.

468) Improper locking (CVE-ID: CVE-2026-68179)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in nsm_dev_ioctl() in drivers/misc/nsm.c when processing an ioctl request with an invalid user pointer during copy_from_user(). A local user can send a crafted ioctl request to cause a denial of service.

The issue is triggered on the pre-lock error path before the mutex is acquired.

469) Improper resource shutdown or release (CVE-ID: CVE-2026-68180)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the intel_th MSC output release path when opening and closing MSC output files. A local user can repeatedly open MSC output files to cause a denial of service.

Each successful MSC output open leaks one device reference because the release callback used for MSC outputs does not drop the reference acquired during open.

470) Use-after-free (CVE-ID: CVE-2026-68181)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in mei_cl_bus_dev_release() in the MEI bus driver when cleaning up a MEI client bus device. A local user can trigger concurrent cleanup access to cause a denial of service.

The issue involves queue cleanup running without the device lock and traversal of file_list after releasing the final bus reference.

471) Improper Initialization (CVE-ID: CVE-2026-68182)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in the comedi_parport interrupt handler and attach logic when handling interrupts during device attachment. A local user can supply a crafted I/O port base address or trigger a premature interrupt to cause a denial of service.

The issue can occur if the interrupt handler runs before the comedi device is fully attached, including when a user-supplied I/O port base address is not backed by real parallel port hardware.

472) Improper resource shutdown or release (CVE-ID: CVE-2026-68183)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the stratix10-svc memory management code when freeing allocated memory after failed lookups. A local user can trigger memory allocation and free operations to cause a denial of service.

473) Out-of-bounds read (CVE-ID: CVE-2026-68184)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a stack out-of-bounds read in mmc_ioctl_cdrom_volume() when processing the CDROMVOLCTRL ioctl on drives that return a non-zero block descriptor length. A local user can invoke the CDROMVOLCTRL ioctl to disclose sensitive information.

The issue is not triggered by CDROMVOLREAD and only occurs on drives that report a non-zero block descriptor length.

474) NULL pointer dereference (CVE-ID: CVE-2026-68186)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in load_misc_binary() and begin_new_exec() when processing a binfmt_misc entry with the open-binary flag after an interpreter open fails with -ENOEXEC. A local user can register a crafted binfmt_misc entry and execute a matching native ELF binary to cause a denial of service.

Exploitation requires binfmt_misc to be mountable in a user namespace and relies on the interpreter being located on a FUSE mount whose server fails the open request with -ENOEXEC.

475) Out-of-bounds read (CVE-ID: CVE-2026-68187)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in transfer_args_to_stack() when processing execve arguments on affected no-MMU builds. A local user can supply an excessively long argument or environment string to trigger the faulty loop behavior and cause a denial of service.

Only CONFIG_MMU=n builds are affected, and the vulnerable code path is used by binfmt_flat and binfmt_elf_fdpic.

476) Use-after-free (CVE-ID: CVE-2026-68188)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in rfcomm_tty_set_termios() and rfcomm_send_rpn() when handling TTY ioctl requests on an RFCOMM device during a concurrent session teardown. A local user can trigger a race condition to cause a denial of service or execute arbitrary code.

The issue is caused by concurrent access to dlc->session without proper locking while krfcommd can unlink the DLC and free the associated session.

477) Use-after-free (CVE-ID: CVE-2026-68189)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in UUID list traversal in hci_sync.c when generating EIR data or class-of-device data during asynchronous command sync work. A local user can add and remove Bluetooth UUID entries through the management socket to cause a denial of service.

The issue is triggered by a race condition between command sync work and management socket operations.

478) Out-of-bounds read (CVE-ID: CVE-2026-68190)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in the rtw_get_wps_ie() function when parsing IE data from network frames. A remote attacker can send a specially crafted network frame to cause a denial of service.

479) Double free (CVE-ID: CVE-2026-68192)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in brcmf_pcie_release_scratchbuffers() when releasing scratch and ring update DMA buffers during reset and device removal. A local user can trigger repeated sequential release to cause a denial of service.

The issue occurs when reset teardown runs before device removal, causing the same DMA allocation to be freed a second time.

480) NULL pointer dereference (CVE-ID: CVE-2026-68193)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in mt7925_rx_check() and mt7925_queue_rx_skb() when handling PKT_TYPE_TXRX_NOTIFY on non-mmio buses. A local attacker can trigger the affected code path to cause a denial of service.

The issue occurs on USB devices because the tx_cleanup callback is NULL for non-mmio queue operations.

481) NULL pointer dereference (CVE-ID: CVE-2026-68194)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in mt7921_rx_check() and mt7921_queue_rx_skb() when handling PKT_TYPE_TXRX_NOTIFY events on non-mmio buses. A local user can trigger the vulnerable code path to cause a denial of service.

The issue affects USB and SDIO bus configurations because the tx_cleanup callback is NULL on those non-mmio buses.

482) NULL pointer dereference (CVE-ID: CVE-2026-68195)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in mt7615_rx_check() and mt7615_queue_rx_skb() when processing PKT_TYPE_TXRX_NOTIFY on non-mmio buses. A local user can trigger the RX worker to handle a crafted TXRX_NOTIFY event to cause a denial of service.

The issue affects mt7663 USB and SDIO buses where the tx_cleanup callback is NULL.

483) Out-of-bounds read (CVE-ID: CVE-2026-68196)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in wilc_parse_assoc_resp_info() in the wilc1000 driver when parsing a received association response. A remote attacker can send a specially crafted short association response frame to disclose sensitive information.

A response shorter than the 6-byte fixed header can trigger the issue, and a response shorter than four bytes may cause an out-of-bounds read of status_code at offsets 2 and 3.

484) NULL pointer dereference (CVE-ID: CVE-2026-68197)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in mwifiex_tdls_add_ht_oper() when setting up a TDLS link to a peer while associated with an access point that advertises HT Capabilities but omits the HT Operation element. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs because the driver checks bcn_ht_cap but dereferences bcn_ht_oper, which may remain NULL after beacon parsing.

485) Use-after-free (CVE-ID: CVE-2026-68198)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in aggr_reset_state() in the ath6kl wireless driver when handling a race between timer callback execution and TID state teardown. A local user can trigger the race condition to cause a denial of service.

The timer callback may continue accessing rx_tid[] and stat[] fields after the associated aggr_conn structure is freed, and it can re-arm itself while the reset routine is running.

486) Out-of-bounds read (CVE-ID: CVE-2026-68199)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in aggr_recv_addba_req_evt() in the ath6kl wireless driver when processing a firmware-supplied ADDBA window size. A remote attacker can supply a crafted window size value to cause a denial of service.

The issue arises because an out-of-range window size can lead to a zero-size or overflowed allocation before subsequent memory access.

487) Use-after-free (CVE-ID: CVE-2026-68202)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ALSA sequencer queue timer handling in snd_seq_timer_delete() and related queue destruction logic when accessing /dev/snd/seq and re-opening a queue timer during queue teardown. A local user can issue crafted sequencer operations to leave a timer instance live and trigger a dereference of freed queue memory to cause a denial of service.

No queue ownership is required.

488) Improper resource shutdown or release (CVE-ID: CVE-2026-68203)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in vivid_init() in drivers/media/test-drivers/vivid/vivid-core.c when handling error paths during device and driver initialization. A local user can trigger initialization failure conditions to cause a denial of service.

The issue involves a device reference leak on platform_device_register() failure and incorrect cleanup after successful driver registration when workqueue creation fails.

489) Race condition (CVE-ID: CVE-2026-68204)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause unexpected results.

The vulnerability exists due to improper state management in vivid_update_format_cap() and vivid_update_format_out() when changing CROP, COMPOSE, or SCALE capability controls after REQBUFS and before STREAMON while the queue state is not properly enforced. A local user can change these controls to cause unexpected results.

The issue affects the vivid media test driver during the window between buffer request setup and the start of streaming.

490) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68205)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper ownership handling in v4l2_async_register_subdev_sensor() when registering a V4L2 subdevice sensor asynchronously. A local user can trigger registration of a crafted or removable sensor driver module to cause a denial of service.

The issue can leave the sensor driver's module owner unset, allowing the module to be removed while the subdevice is still in use by a notifier such as a CSI-2 receiver bridge driver.

491) Improper input validation (CVE-ID: CVE-2026-68206)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the V4L2 HEVC slice control validation path when processing HEVC slice parameters. A local user can supply crafted active L0/L1 reference counts to cause a denial of service.

The issue affects stateless HEVC drivers, and validation was missing before driver-specific code consumed the shared control data.

492) Improper resource shutdown or release (CVE-ID: CVE-2026-68207)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the v4l2 device registration handling in vpe_probe() when probing the TI VPE driver with missing vpe_top resources. A local user can trigger device probing in this state to cause a denial of service.

The issue occurs on an error path after v4l2_device_register() succeeds, leaving the v4l2 device registered when probe initialization fails.

493) Improper resource shutdown or release (CVE-ID: CVE-2026-68209)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the sun4i_csi_start_streaming() path of the sun4i-csi driver when handling streaming startup with an unsupported CSI format. A local user can trigger streaming initialization with a format that has no matching CSI format to cause a denial of service.

The issue occurs because queued video buffers are not returned on the error path after they have already been handed to the driver by the vb2 framework.

494) Improper resource shutdown or release (CVE-ID: CVE-2026-68210)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the stm32 dcmi driver async notifier handling when probing the device and reset operations fail. A local user can trigger a probe failure to cause a denial of service.

The issue occurs because the notifier remains registered on the error path when probe exits before the normal remove path is reached.

495) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-68212)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in saa7134_video_init1 in the saa7134 video driver when probing a device and initializing video and VBI queues. A local user can trigger initialization failures that leave allocated resources unreleased and may result in use of uninitialized DMA resources to cause a denial of service.

The issue occurs during device probing before the device is fully registered, so the normal cleanup path is not executed.

496) Improper resource shutdown or release (CVE-ID: CVE-2026-68213)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in rtl2832_sdr_start_streaming() and queued buffer handling when handling start_streaming() failures. A local user can trigger a streaming start failure to cause a denial of service.

The issue occurs because buffers queued before streaming are not returned to the videobuf2 framework on error paths, which can trigger a WARN_ON and leak queued buffers.

497) Use-after-free (CVE-ID: CVE-2026-68214)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in rtl2832_remove() when removing a device while concurrent I2C transfers are still in flight through the mux adapter. A local user can trigger device removal during concurrent I2C activity to cause a denial of service.

The issue arises because delayed work may be rescheduled after cancellation by a concurrent thread during device teardown.

498) Improper resource shutdown or release (CVE-ID: CVE-2026-68215)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the si476x radio driver probe error path when handling device initialization failures. A local user can trigger a probe failure to cause a denial of service.

499) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-68216)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in start_streaming() in the pwc USB camera driver when handling queued video buffers during streaming startup failure conditions. A local user can trigger a streaming startup failure to cause a denial of service.

The issue can be triggered when the USB device is already disconnected or when locking is interrupted by a signal.

500) Improper resource shutdown or release (CVE-ID: CVE-2026-68217)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in start_streaming() in the pwc USB media driver when handling a start_streaming() failure after isochronous URB submission. A local user can trigger a streaming start failure to cause a denial of service.

The issue occurs because a buffer moved from queued_bufs into fill_buf is not drained on the error path, which leads to a WARN_ON(owned_by_drv_count).

501) Improper resource shutdown or release (CVE-ID: CVE-2026-68218)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the dm1105 driver remove() callback when removing the device. A local user can trigger device removal to cause a denial of service.

502) Improper input validation (CVE-ID: CVE-2026-68219)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the imx8-isi scaling configuration logic when processing crafted image scaling parameters. A local user can supply specially crafted width or height values to cause a denial of service.

The issue can cause the affected process to stop responding even when interrupted with Ctrl+C.

503) Memory leak (CVE-ID: CVE-2026-68220)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in the imx8-isi crossbar and pipe cleanup paths when repeatedly loading and unloading the affected kernel module. A local user can trigger module initialization and cleanup cycles to cause a denial of service.

The issue occurs because subdevice active state allocated by v4l2_subdev_init_finalize() is not released during cleanup.

504) Improper resource shutdown or release (CVE-ID: CVE-2026-68221)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the npcm-video driver probe and remove paths when handling device initialization failures or device removal. A local user can trigger the driver probe or unbind operations to cause a denial of service.

The issue can leak both the allocated npcm_video structure and a reserved memory association entry under certain initialization failure conditions.

505) Improper resource shutdown or release (CVE-ID: CVE-2026-68222)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in msi2500_start_streaming() and queued buffer cleanup handling when starting streaming after buffers have been queued by the vb2 framework. A local user can trigger start_streaming() error paths to cause a denial of service.

The issue occurs on multiple start_streaming() failure paths, including device disconnect, interrupted locking, USB ADC setup failure, isochronous initialization failure, and streaming command failure. In some cases, queued buffers are not returned as expected and submitted isochronous URBs may remain active without being consumable by the driver.

506) Improper resource shutdown or release (CVE-ID: CVE-2026-68223)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the vdec_open() function when opening the video decoder device and initialization of controls fails. A local user can open the device to cause a denial of service.

The issue occurs in the error path after m2m context allocation, resulting in a kernel memory leak.

507) NULL pointer dereference (CVE-ID: CVE-2026-68225)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in alvium_ctrl_init in the alvium CSI-2 driver when initializing V4L2 controls. A local user can trigger the vulnerable control initialization path to cause a denial of service.

508) NULL pointer dereference (CVE-ID: CVE-2026-68226)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in cx23885_dev_setup() in the cx23885 driver when handling a memory mapping failure for PCI BAR0. A local attacker can trigger the vulnerable code path to cause a denial of service.

509) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68227)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource lifetime management in the cx231xx USB media driver when the driver is unbound from a USB interface without physical device disconnection. A local user can trigger driver unbind or reconfiguration conditions to cause a denial of service.

The issue can be triggered during probe deferral or configuration changes.

510) Race condition (CVE-ID: CVE-2026-68228)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the wave5 encoder buffer handling in drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c when processing encoder completion and re-queuing buffers. A local user can queue the same buffer before it is removed from the m2m ready queue to cause a denial of service.

The issue can result in a self-referential ready-queue entry, after which list pointers are poisoned when the entry is deleted.

511) Out-of-bounds read (CVE-ID: CVE-2026-68229)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in _cedrus_write_ref_list() when processing malformed or unsupported H.264 reference list entries. A local user can provide crafted stateless slice control reference list entries to disclose sensitive information.

512) Improper resource shutdown or release (CVE-ID: CVE-2026-68231)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in airspy_start_streaming() in the airspy USB media driver when starting streaming after the USB device has been disconnected. A local user can trigger streaming with queued buffers present to cause a denial of service.

The issue occurs because buffers accepted before start_streaming() are not returned on the error path.

513) Improper resource shutdown or release (CVE-ID: CVE-2026-68234)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in amdgpu_bo_create_reserved() when handling repeated calls with a non-NULL BO pointer. A local user can trigger repeated resume or firmware buffer reload operations to cause a denial of service.

The issue occurs because repeated calls increase the BO pin count, while teardown only removes a single pin reference, preventing the buffer object from being moved, swapped, or evicted.

514) NULL pointer dereference (CVE-ID: CVE-2026-68235)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in dce100_find_first_free_match_stream_enc_for_link() and link_set_dpms_on() when handling DisplayPort MST stream encoder assignment. A local user can trigger DisplayPort MST multi-monitor handling to cause a denial of service.

The issue affects DCE8-class ASICs in a DisplayPort MST daisy-chain setup, such as when a second monitor is hot-plugged or already connected at boot.

515) Double free (CVE-ID: CVE-2026-68236)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in dm_update_crtc_state() in the AMD display manager when handling error paths after releasing new_stream on the skip_modeset path. A local user can trigger a later error condition after the initial release to cause a denial of service.

The issue occurs because a dangling pointer may be released again after a color management failure reaches the fail label.

516) NULL pointer dereference (CVE-ID: CVE-2026-68243)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the i915 GEM context SSEU parameter handling in set_proto_ctx_sseu() when applying I915_CONTEXT_PARAM_SSEU to a context engine slot previously set to I915_ENGINE_CLASS_INVALID or I915_ENGINE_CLASS_INVALID_NONE. A local user can configure the same slot and trigger the affected operation to cause a denial of service.

517) Memory leak (CVE-ID: CVE-2026-68244)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in the i915 GEM proto context creation extension handling when processing user extensions after a successful BALANCE/PARALLEL_SUBMIT extension. A local user can submit crafted context creation extensions to cause a denial of service.

The issue occurs when an error is triggered while processing a subsequent user extension after BALANCE/PARALLEL_SUBMIT has already succeeded.

518) Reachable assertion (CVE-ID: CVE-2026-68246)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of invalid alignment conditions in gfx_v11_0.c when processing misaligned GPU addresses and fence addresses. A local user can trigger a kernel BUG_ON condition to cause a denial of service.

519) Improper input validation (CVE-ID: CVE-2026-68247)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the panel type selection logic in drivers/gpu/drm/i915/display/intel_bios.c when parsing LFP Data Block panel_type2 values from VBT data. A local user can provide a specially crafted panel_type2 value to cause a denial of service.

The issue affects the handling of LFP2 device panel selection.

520) NULL pointer dereference (CVE-ID: CVE-2026-68248)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in active_instance in the i915 DRM driver when handling memory allocation failure during GFP_ATOMIC allocation. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs when kmem_cache_alloc returns NULL and the function returns node->base derived from a NULL node.

521) Reachable assertion (CVE-ID: CVE-2026-68249)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a reachable assertion in the sdma_v5_0 fence emission logic when processing a crafted fence address. A local user can trigger the BUG_ON() condition to cause a denial of service.

The issue results in a kernel crash rather than continued execution.

522) Reachable assertion (CVE-ID: CVE-2026-68250)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a BUG_ON assertion in sdma_v5_2_ring_emit_fence() in the amdgpu sdma_v5_2 component when processing a crafted fence address. A local user can trigger the BUG_ON condition to cause a denial of service.

523) Reachable assertion (CVE-ID: CVE-2026-68251)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a reachable kernel assertion in sdma_v6_0_ring_emit_fence() in the amdgpu sdma v6.0 driver when processing a fence address with the low two bits set. A local user can trigger the vulnerable code path to cause a denial of service.

524) Out-of-bounds write (CVE-ID: CVE-2026-68253)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the intel_hdcp_required_content_stream function when processing HDCP content stream data. A local user can trigger a stream count overflow to cause a denial of service.

525) Improper input validation (CVE-ID: CVE-2026-68254)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the intel_vrr.c VRR capability handling when processing EDID monitor range data. A local user can provide crafted min/max vertical frequency values to trigger a division by zero and cause a denial of service.

526) Out-of-bounds read (CVE-ID: CVE-2026-68255)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in virtio_get_edid_block() when parsing device-supplied EDID responses. A remote privileged user can supply a crafted virtio-gpu EDID response with a large reported size and high extension count to disclose sensitive information.

Exploitation requires control of a malicious virtio-gpu backend.

527) Memory leak (CVE-ID: CVE-2026-68256)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in detect_link_and_local_sink in the AMD display link detection code when handling a DisplayPort alt mode timeout. A local user can trigger the timeout path to cause a denial of service.

528) Improper input validation (CVE-ID: CVE-2026-68259)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in allocate_event_notification_slot in the amdkfd event handling code when processing a user-supplied restore event id. A local user can provide an out-of-bounds event id to cause a denial of service.

The issue is related to the restore_id option used by CRIU.

529) Race condition (CVE-ID: CVE-2026-68260)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition leading to a NULL pointer dereference in the PowerVR GPU virtual memory mapping logic when performing map or unmap operations while a find operation is in progress. A local user can issue crafted ioctl requests to trigger the NULL pointer dereference and cause a denial of service.

530) NULL pointer dereference (CVE-ID: CVE-2026-68261)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in pvr_context_create and pvr_vm_context_lookup handling when processing a DRM_IOCTL_PVR_CREATE_CONTEXT ioctl request with an invalid VM context handle. A local user can send a specially crafted ioctl request to cause a denial of service.

531) Incorrect calculation (CVE-ID: CVE-2026-68262)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information or corrupt memory in userspace.

The vulnerability exists due to improper pointer arithmetic in pvr_set_uobj_array() when copying an array of kernel objects to a userspace array with a differing element stride. A local user can supply crafted stride values to cause later copies to read from incorrect kernel addresses or write to incorrect userspace offsets to disclose sensitive information or corrupt memory in userspace.

The issue occurs in the slow path when the userspace element size differs from the kernel object size, and padding is not cleared for each element.

532) Double free (CVE-ID: CVE-2026-68263)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in drm_sched_entity_fini() in the PowerVR DRM queue cleanup path when destroying queues after queue kill handling. A local user can trigger queue teardown in a crafted context lifecycle to cause a denial of service.

The issue is associated with a refcount underflow and use-after-free warning in the drm/imagination PowerVR driver.

533) Use-after-free (CVE-ID: CVE-2026-68266)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the xe dma-buf imported buffer object handling when tearing down imported buffer objects after dma_buf_dynamic_attach() or buffer object creation fails. A local user can trigger creation of a crafted imported dma-buf buffer object to cause a denial of service.

The issue can be reached on failure paths where the buffer object already references the exporter's reservation object and that reservation object is later accessed asynchronously during delayed deletion.

534) Observable discrepancy (CVE-ID: CVE-2026-68269)

CWE-ID: CWE-203 - Observable discrepancy

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper restriction of speculative execution in the parallel submission slot handling in set_proto_ctx_engines_parallel_submit() when processing a userspace-controlled parallel submission slot. A local user can supply a crafted slot value to disclose sensitive information.

535) Improper handling of exceptional conditions (CVE-ID: CVE-2026-68271)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in nouveau_uvmm_vm_bind_ucopy() and nouveau_exec_ucopy() when handling failed u_memcpya() allocations during user copy operations. A local user can trigger an allocation failure to cause a denial of service.

The issue can lead to a kernel oops from dereferencing an ERR_PTR value, and a different failure path can also result in a memory leak.

536) NULL pointer dereference (CVE-ID: CVE-2026-68272)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an improper input validation leading to a NULL-pointer dereference in amdgpu_cs_pass1() and amdgpu_cs_p2_shadow() when processing an undersized AMDGPU_CHUNK_ID_CP_GFX_SHADOW chunk. A local user can submit a specially crafted chunk with zero length to cause a denial of service.

This is reachable by an unprivileged process in the render group.

537) Use-after-free (CVE-ID: CVE-2026-68273)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free and NULL pointer dereference in the amdgpu context pstate handling code when initializing or finalizing GPU contexts while stable pstate state changes are processed. A local user can create and tear down crafted contexts to cause a denial of service.

The issue arises because context pstate ownership transitions were not consistently protected by the stable_pstate_ctx_lock, and sysfs-triggered state changes can race with context handling.

538) Out-of-bounds read (CVE-ID: CVE-2026-68277)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the sideband reply parsers in drm_dp_mst_topology.c when parsing crafted sideband reply messages. A local user can provide a crafted message with a truncated 2-byte field to disclose sensitive information.

The out-of-bounds read can access data from adjacent struct fields including curchunk_len, curchunk_idx, and curlen.

539) Out-of-bounds write (CVE-ID: CVE-2026-68278)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to out-of-bounds write in drm_dp_sideband_append_payload() when processing forged DP MST sideband reply messages from a connected device. An attacker with physical access can send crafted sideband reply data to cause memory corruption.

The issue is reachable from a DP MST device over a physical connection.

540) Out-of-bounds read (CVE-ID: CVE-2026-68279)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in drm_dp_sideband_parse_remote_dpcd_read() and drm_dp_sideband_parse_remote_i2c_read_ack() when parsing remote DPCD and I2C sideband reply messages from an MST hub. A remote attacker can send a specially crafted sideband reply with an oversized num_bytes value to disclose sensitive information.

The issue can be triggered by a malicious or misbehaving MST hub.

541) Improper resource shutdown or release (CVE-ID: CVE-2026-68280)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in cdns_dsi power management operations when handling runtime suspend and system suspend transitions. A local user can trigger suspend operations to cause a denial of service.

The issue results in a kernel warning when clocks are disabled twice.

542) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-68281)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of dependencies in prepare_job() in the PowerVR DRM scheduler queue handling code when submitting paired geometry and fragment jobs to the fragment CCCB. A local user can submit specially crafted paired jobs to cause a denial of service.

The issue can lead to kernel warnings and potentially job timeouts when the fragment command queue is almost full.

543) Use-after-free (CVE-ID: CVE-2026-68284)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in tcp_bpf_sendmsg() when two threads send on the same socket and an error occurs after waiting for socket memory. A local user can trigger concurrent send operations to cause a denial of service.

The issue occurs in the sockmap BPF path and involves stale cork state being mistaken for a stack-local temporary message.

544) Race condition (CVE-ID: CVE-2026-68286)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a race condition in net_dm_packet_trace_kfree_skb_hit() and net_dm_hw_trap_packet_probe() in net/core/drop_monitor.c when updating 64-bit per-CPU statistics after releasing drop_queue.lock with interrupts re-enabled. A local attacker can trigger reentrant execution during the stats update to cause a denial of service.

On 32-bit architectures, a nested interrupt on the same CPU during the seqcount-based update can corrupt the seqcount state or statistics value.

545) Incorrect Calculation of Buffer Size (CVE-ID: CVE-2026-68287)

CWE-ID: CWE-131 - Incorrect Calculation of Buffer Size

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper calculation of buffer size in net/core/drop_monitor.c when handling 64-bit drop monitor attributes on affected architectures. A local user can trigger packet report generation to cause a denial of service.

This affects 32-bit architectures without CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS because 64-bit netlink attributes may require additional padding for alignment.

546) Use of uninitialized resource (CVE-ID: CVE-2026-68288)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to uninitialized memory exposure in NET_DM_ATTR_PAYLOAD handling in net_dm_packet_report_fill() and net_dm_hw_packet_report_fill() when constructing netlink messages containing packet payload data. A local user can receive a specially crafted netlink message to disclose sensitive information.

The issue occurs when the packet payload length is not 4-byte aligned, causing 1 to 3 padding bytes to remain uninitialized and be leaked to user space.

547) Integer overflow (CVE-ID: CVE-2026-68289)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in tipc_recvmsg() and tipc_recvstream() when processing oversized user-supplied buffer lengths. A local user can supply an excessively large buffer length via io_uring provided buffers to cause a denial of service.

The issue can trigger a WARN_ON that may lead to a kernel panic on systems configured with panic_on_warn.

548) Use-after-free (CVE-ID: CVE-2026-68290)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in rds_tcp_skbuf_handler in the RDS TCP sysctl handler when handling a concurrent sysctl write during network namespace teardown. A local user can trigger a concurrent sysctl write to cause a denial of service.

The race occurs because the network namespace is derived from a listen socket that may already have been freed.

549) Out-of-bounds read (CVE-ID: CVE-2026-68293)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the MCIA register handling in the mlx5 driver when processing module EEPROM reads via ethtool. A local user can trigger a read of module EEPROM data to cause a denial of service.

The issue is detected on kernels built with FORTIFY_SOURCE, where it results in a kernel BUG.

550) Improper access control (CVE-ID: CVE-2026-68294)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass network namespace isolation.

The vulnerability exists due to improper access control in the AF_QIPCRTR socket creation logic and global QRTR state handling when creating and using QRTR sockets from a separate network namespace. A local user can create an AF_QIPCRTR socket in another network namespace and send crafted QRTR datagrams to sockets owned by a different namespace to bypass network namespace isolation.

The receiving socket may treat the message as originating from node id 1, making it indistinguishable from a legitimate local client.

551) Improper input validation (CVE-ID: CVE-2026-68297)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in TIPC netlink MTU property handling when processing user-supplied MTU values through TIPC media or bearer configuration requests. A local user can supply an MTU value greater than 65535 to trigger a division by zero and cause a denial of service.

Exploitation is possible by an unprivileged user via a user namespace.

552) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-68299)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of encapsulated packet headers in vmxnet3_get_hdr_len() when processing Geneve-encapsulated packets. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue is triggered when descriptor fields describe the inner header instead of the outer header, including cases where the outer protocol is UDP or the outer and inner IP versions differ.

553) Improper Authentication (CVE-ID: CVE-2026-68300)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass authentication.

The vulnerability exists due to improper authentication in sctp_auth_chunk_verify() when processing SCTP chunks with a NULL auth_chunk. A remote user can send a specially crafted SCTP chunk to bypass authentication.

This can occur for new connections or when no AUTH chunk precedes a COOKIE-ECHO chunk.

554) Memory leak (CVE-ID: CVE-2026-68301)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in hsr_del_port() when unregistering or destroying an HSR slave device while HSR is active. A local user can unregister or destroy a slave device to cause a denial of service.

The issue occurs because VLAN 0 and other synced VLANs can remain referenced on the slave device after it is detached from the HSR master.

555) Use-after-free (CVE-ID: CVE-2026-68302)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service or potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the AMT packet handling logic in drivers/net/amt.c when processing crafted network packets that trigger skb header pulls and head reallocation. A remote attacker can send specially crafted packets to cause a denial of service or potentially execute arbitrary code.

The issue affects multiple AMT receive and transmit paths that cache skb header pointers and later dereference them after helpers such as pskb_may_pull(), ip_mc_may_pull(), ipv6_mc_may_pull(), iptunnel_pull_header(), ip_mc_check_igmp(), or ipv6_mc_check_mld() move the skb head.

556) NULL pointer dereference (CVE-ID: CVE-2026-68303)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the vc4_hvs_unbind and vc4_v3d_unbind functions when unbinding dependent vc4 drivers after vc4-drm removal. A local user can trigger driver unbind operations to cause a denial of service.

The issue occurs because the dependent drivers access master driver data after the vc4-drm device has already been removed.

557) Improper Initialization (CVE-ID: CVE-2026-68304)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in the brcmfmac cfg80211 key management handling when processing 802.1X-SHA256 PMK configuration requests. A local user can send a crafted netlink request to trigger a kernel warning and cause a denial of service.

The issue occurs when 802.1X-SHA256 mode is used without the required firmware supplicant configuration.

558) NULL pointer dereference (CVE-ID: CVE-2026-68306)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in mt7996_mcu_sta_bfer_eht() when handling EHT PHY capability data. A local attacker can trigger the vulnerable code path to cause a denial of service.

559) NULL pointer dereference (CVE-ID: CVE-2026-68308)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the mt7996 MCU handling code when processing HE PHY capability data. A local user can trigger code paths that use a NULL capability pointer to cause a denial of service.

560) NULL pointer dereference (CVE-ID: CVE-2026-68309)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in mt76_connac_mcu_uni_bss_he_tlv() when processing HE BSS TLV data. A local user can trigger the vulnerable code path to cause a denial of service.

561) NULL pointer dereference (CVE-ID: CVE-2026-68310)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in HE capability handling in mt7915_mcu_bss_he_tlv() and mt7915_mcu_sta_bfer_tlv() when processing HE-specific setup for a vif type with no matching capability entry. A local user can trigger HE-specific processing to cause a denial of service.

562) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-68313)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in __tipc_nl_compat_dumpit in the TIPC netlink compatibility handler when processing dumpit callback results. A local user can trigger a negative return value path to cause a denial of service.

The issue can lead to an infinite loop that prevents genl_mutex from being released, causing tasks waiting on the mutex to starve in D state.

563) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-68314)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in mctp_i3c_mod_init() in the mctp i3c driver when registering the i3c notifier and initializing existing buses before driver registration completes. A local user can trigger a driver registration failure to cause a denial of service.

The issue leaves a notifier pointing to a module that failed to load and leaks allocated bus objects.

564) Integer overflow (CVE-ID: CVE-2026-68315)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer overflow in sctp_process_strreset_inreq() when processing a crafted SCTP RESET_IN_REQUEST from a peer. A remote attacker can send a specially crafted SCTP stream reset request to cause a denial of service.

Exploitation is only possible on interfaces with MTU greater than 65535, such as loopback with IPv6 jumbograms.

565) Race condition (CVE-ID: CVE-2026-68317)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition and NULL pointer dereference in the pds_core auxiliary device add and delete logic when concurrent add or delete operations access the same auxiliary device slot. A local user can trigger concurrent device add or delete operations to cause a denial of service.

The issue arises because the shared slot is not consistently checked and updated under config_lock in both paths.

566) Use-after-free (CVE-ID: CVE-2026-68318)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the pds_core driver workqueue handling during device removal and teardown when processing queued work and interrupt-driven events. A local user can trigger device removal or teardown activity to cause a denial of service.

The issue can be reached when queued work is scheduled after the workqueue has been destroyed, including timeout handling in device command reset and NotifyQ interrupt activity before the interrupt handler is freed.

567) Deadlock (CVE-ID: CVE-2026-68319)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock in the pds_core reset and device removal handling when a PCI reset thread runs concurrently with device removal. A local user can trigger concurrent reset and remove operations to cause a denial of service.

The issue occurs because the reset work waits for a device lock that is already held during the unbind sequence, while device removal waits for the workqueue to complete.

568) Heap-based buffer overflow (CVE-ID: CVE-2026-68320)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in sctp_association_init and SCTP authentication chunk handling when processing endpoint authentication chunk lists containing more than 16 entries. A local user can add excessive chunk identifiers to trigger memory corruption and cause a denial of service.

569) NULL pointer dereference (CVE-ID: CVE-2026-68322)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the RDS IPv6 address check logic when binding an RDS socket to an IPv6 address while IPv6 is disabled. A local user can bind an RDS socket to an IPv6 address to cause a denial of service.

The issue occurs on systems booted with the ipv6.disable=1 parameter.

570) Out-of-bounds write (CVE-ID: CVE-2026-68324)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds write in dmar_latency_disable() when disabling latency statistics for a type value greater than 0. A local user can trigger the vulnerable code path to cause a denial of service.

When the type value is greater than 0, the operation writes beyond the end of the allocated array and corrupts adjacent memory.

571) Stack-based buffer overflow (CVE-ID: CVE-2026-68325)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in the ivrs_acpihid command-line parser when parsing the ivrs_acpihid kernel command-line parameter. A local attacker can supply a specially crafted parameter with more than four entries to cause a denial of service.

572) Out-of-bounds read (CVE-ID: CVE-2026-68326)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in mwifiex_process_uap_event() and the assoc_req_ies parsing path when processing a firmware-reported uAP association event with a crafted event length. A local attacker can supply a malicious or malformed event from a mwifiex device to disclose sensitive information.

The issue can be triggered by a malicious or malfunctioning mwifiex USB, SDIO, or PCIe device while the interface is operating in AP/uAP mode. An underflow in the calculated length may also cause stale event buffer bytes to be exposed through an NL80211_CMD_NEW_STATION notification.

573) NULL pointer dereference (CVE-ID: CVE-2026-68327)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in wanxl_reset in the wanxl PCI device removal path when handling early probe failures before BAR mapping. A local user can trigger device initialization failure conditions to cause a denial of service.

The issue occurs on an error path where the PLX MMIO BAR has not yet been mapped, leaving card->plx NULL when cleanup invokes the reset routine.

574) NULL pointer dereference (CVE-ID: CVE-2026-68328)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in nfp_cpp_resource_find() and nfp_resource_try_acquire() when opening a resource with a matching resource-table entry after mutex allocation fails. A local user can trigger resource acquisition to cause a denial of service.

This issue was identified through static analysis and confirmed by manual source review.

575) Race condition (CVE-ID: CVE-2026-68329)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to a race condition in iommu_completion_wait() in the AMD IOMMU subsystem when handling concurrent command completion waits across multiple CPUs. A local user can trigger concurrent IOMMU command activity to cause a use-after-free condition.

The issue occurs because the code may return without waiting for previously queued commands to complete in hardware, which can leave stale translations in use while related page-table pages are freed.

576) Improper resource shutdown or release (CVE-ID: CVE-2026-68331)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the dpaa2 Ethernet MAC disconnect path when disconnecting a MAC endpoint device. A local user can repeatedly trigger connect and disconnect operations to cause a denial of service.

The issue leaks a device reference stored in mac->mc_dev on each successful connect that is later disconnected.

577) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-68333)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper release of a resource in dpaa2_switch_port_disconnect_mac in the dpaa2-switch driver when disconnecting a MAC endpoint device. A local user can repeatedly connect and disconnect the MAC endpoint to cause a denial of service.

578) Use-after-free (CVE-ID: CVE-2026-68335)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the RDS receive path when delivering an incoming message across network namespace boundaries. A local user can create network namespaces and send a crafted message to trigger a dangling connection reference and potentially execute arbitrary code.

The issue is reachable from unprivileged user namespaces using CLONE_NEWUSER and CLONE_NEWNET.

579) NULL pointer dereference (CVE-ID: CVE-2026-68336)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in bond_send_validate() in the bonding driver when processing ARP monitor validation with IPv6 disabled. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs when the system is booted with the 'ipv6.disable=1' parameter.

580) Race condition (CVE-ID: CVE-2026-68338)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in packet_set_ring() and packet fanout hook handling in net/packet/af_packet.c when reconfiguring a packet socket ring while a network device is being unregistered. A local user can trigger ring reconfiguration during device unregister handling to cause a denial of service.

The issue occurs when a stale running state causes fanout hook re-registration after the device binding has already been invalidated.

581) Out-of-bounds read (CVE-ID: CVE-2026-68339)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in btusb_recv_event_realtek() when processing short Realtek vendor events. A local attacker can send a specially crafted Bluetooth HCI vendor event to cause a denial of service.

Short vendor events may be misclassified as coredump events because the code inspects a missing third byte.

582) Out-of-bounds read (CVE-ID: CVE-2026-68340)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the OCC poll response parser in drivers/hwmon/occ/common.c when parsing a truncated transport response. A local user can supply a malformed poll response to cause a denial of service.

The issue occurs because the parser used the backing-array capacity instead of the current response data length as the parse boundary, and malformed-response errors were not propagated before the OCC was published as active.

583) Out-of-bounds read (CVE-ID: CVE-2026-68343)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in parse_dfs_referrals() in the SMB client DFS referral parser when processing a malformed DFS referral response with an oversized PathConsumed value. A remote attacker can send a specially crafted DFS referral response to cause an out-of-bounds read.

The issue occurs when PathConsumed is larger than the search name length used for later DFS path parsing.

584) Memory leak (CVE-ID: CVE-2026-68346)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in cs35l41_get_acpi_mute_state() when repeatedly querying the ACPI _DSM mute state. A local user can trigger repeated successful queries to cause a denial of service.

Each successful query leaks the returned _DSM result object because it is owned by the caller and is not freed after use.

585) Out-of-bounds read (CVE-ID: CVE-2026-68346)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in cs35l41_get_acpi_mute_state() when processing a malformed ACPI _DSM firmware response. A local user can provide a crafted firmware response to cause a denial of service.

The issue occurs because the code assumes the returned ACPI object is a buffer with at least one byte and directly dereferences the returned buffer pointer.

586) Out-of-bounds read (CVE-ID: CVE-2026-68348)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the TAS2781 firmware parser when parsing malformed firmware description strings. A local user can supply a crafted firmware image without a NUL terminator to cause a denial of service.

The issue occurs because variable-length description strings are processed with strlen() before verifying that the terminator is present within the firmware buffer.

587) Heap-based buffer overflow (CVE-ID: CVE-2026-68349)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in carl9170_rx_stream() when processing USB transfer data in the rx stream failover path. A local attacker can provide specially crafted transfer data to cause a denial of service.

The issue is triggered when two transfers are near the maximum size and their combined copied length exceeds the 65535-byte failover SKB, resulting in skb_over_panic.

588) Out-of-bounds read (CVE-ID: CVE-2026-68350)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in carl9170_tx_process_status() when processing firmware-controlled TX status entries. A local attacker can provide a crafted firmware response with an oversized hdr.ext value to disclose sensitive information.

The issue is caused by an off-by-two bounds check error that allows two extra iterations past valid _tx_status entries.

589) Out-of-bounds read (CVE-ID: CVE-2026-68351)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in carl9170_cmd_callback() when processing a firmware command response with a length mismatch. A remote attacker can send a specially crafted firmware response to disclose sensitive information.

590) Out-of-bounds read (CVE-ID: CVE-2026-68352)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in ath6kl_wmi_connect_event_rx() when parsing firmware-controlled connect event information elements. A local attacker can supply crafted length fields to trigger out-of-bounds reads and disclose sensitive information.

The issue can also corrupt the wmi->is_wmm_enabled state during parsing.

591) Out-of-bounds read (CVE-ID: CVE-2026-68353)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ath6kl_wmi_tx_complete_event_rx() when processing a crafted WMI TX complete event from firmware. A local user can supply an inflated num_msg field to disclose sensitive information.

The num_msg field is firmware-controlled and can cause reads of up to 1020 bytes past the WMI event buffer.

592) Improper handling of exceptional conditions (CVE-ID: CVE-2026-68354)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of fragment list boundaries in the firewire networking fragmented datagram reassembly logic when processing fragmented datagrams. A remote attacker can send specially crafted fragmented datagrams to cause a denial of service.

The issue can prevent complete datagrams from being correctly recognized during reassembly.

593) Out-of-bounds read (CVE-ID: CVE-2026-68355)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in ath11k_hal_rx_msdu_list_get() when processing msdu descriptor entries. A local attacker can trigger a zero buffer address in the first msdu_details entry to cause a denial of service.

594) Use-after-free (CVE-ID: CVE-2026-68357)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in watchdog_unregister_governor() and the watchdog pretimeout governor handling logic when unregistering a watchdog governor that is still referenced as default_gov. A local user can trigger governor unregistration and subsequent watchdog device registration or reassignment to cause a denial of service.

The issue occurs when the unregistered governor remains referenced through a dangling default_gov pointer, affecting both newly registered watchdog devices and existing devices whose governor is reassigned.

595) Use-after-free (CVE-ID: CVE-2026-68359)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in the nzxt-smart2 driver probe function when stopping a device after device I/O has been started and probe subsequently fails. A local user can trigger device initialization failure to execute arbitrary code.

The issue is caused by a race condition between hid_input_report() and execution immediately following hid_device_io_start() during probe error handling.

596) Use-after-free (CVE-ID: CVE-2026-68360)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in the corsair-cpro driver probe function when handling device I/O during probe failure after I/O start. A local user can trigger the vulnerable code path to execute arbitrary code.

The issue is caused by a race condition between hid_input_report() and execution immediately following hid_device_io_start() during probing.

597) Use-after-free (CVE-ID: CVE-2026-68361)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in corsairpsu_probe() and HID input report handling when stopping a device after probe failure while input reports are still being processed. A local user can trigger the race condition during device initialization failure to execute arbitrary code.

The issue is triggered by a race condition between hid_input_report() and the code path immediately following hid_device_io_start() during probe failure.

598) NULL pointer dereference (CVE-ID: CVE-2026-68362)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in ath11k_hal_srng_access_begin and the ath11k driver restart path when handling firmware ready events after a failed initialization. A local user can trigger a subsystem restart after firmware ready handling fails to cause a denial of service.

The issue occurs because the driver can enter recovery with an inconsistent registered state after firmware ready processing does not complete successfully.

599) Use-after-free (CVE-ID: CVE-2026-68363)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in ath9k_hif_request_firmware() in drivers/net/wireless/ath/ath9k/hif_usb.c when handling a failed asynchronous firmware request during concurrent USB device disconnect. A local user can trigger a firmware download failure and a concurrent disconnect to cause a denial of service.

The issue is triggered by a race condition between the firmware callback running on the events workqueue and device disconnect, leading to a read from freed memory.

600) Out-of-bounds write (CVE-ID: CVE-2026-68365)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the io_edgeport USB serial driver ring buffer when processing interrupt-status packets that report transmit credits. A local user can provide a malicious or non-conforming USB device that returns excessive transmit credits to cause a denial of service.

Exploitation requires the system to interact with a USB serial device using the affected driver.

601) Out-of-bounds read (CVE-ID: CVE-2026-68366)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in uvc_send_response() when processing a UVCIOC_SEND_RESPONSE ioctl with a crafted response length. A local user can supply a crafted struct uvc_request_data to cause an out-of-bounds read and disclose sensitive information.

602) Use-after-free (CVE-ID: CVE-2026-68367)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the f_tcm delayed set_alt work handler when processing delayed USB gadget alternate-setting changes during disconnect or function teardown. A local user can trigger function unlink or teardown while delayed set_alt work is still pending to cause a denial of service.

The issue was reproduced by KASAN in tcm_delayed_set_alt after the function state was freed through configfs unlink operations.

603) Out-of-bounds read (CVE-ID: CVE-2026-68368)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ncm_unwrap_ntb() in the USB gadget NCM function when parsing host-supplied NTBs. A remote attacker can supply a crafted NTB with invalid block lengths, datagram offsets, or datagram lengths to disclose sensitive information.

Exploitation requires a malicious USB host interacting with a system using the affected USB gadget functionality.

604) Infinite loop (CVE-ID: CVE-2026-68369)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of copy_to_user() results in printer_read() in the USB gadget printer function when processing read requests with an unwritable user buffer. A local user can trigger a read operation with an unwritable user buffer to cause a denial of service.

The issue can result in an infinite loop if RX data is available and an iteration makes no progress.

605) Race condition (CVE-ID: CVE-2026-68370)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in dummy_hcd shared fifo_req handling when processing small IN transfers through the emulated single-request FIFO fast-path. A local user can trigger concurrent request queueing and completion handling to cause a denial of service.

The issue can overwrite the request completion function pointer while a completion callback is still running, leading to a general protection fault or page fault in dummy_timer.

606) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-68371)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference count handling in the omap2430_probe() function when probing the omap2430 USB MUSB platform device. A local user can trigger the driver probe to cause a denial of service.

The issue can leave pdev->dev.of_node with an unbalanced reference count because a borrowed device tree node pointer is released incorrectly.

607) Use-after-free (CVE-ID: CVE-2026-68372)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the USB Type-C connector handling in drivers/usb/core/port.c when processing Thunderbolt dock unplug and concurrent partner-disconnect events. A local user can trigger a crafted hot-unplug race to cause a denial of service.

Exploitation requires a race between component unbind, USB disconnect, and UCSI partner-disconnect handling during dock hot-plug events.

608) Out-of-bounds read (CVE-ID: CVE-2026-68373)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in at76_guess_freq() when processing truncated beacon or probe response frames during scanning. A remote attacker can send a specially crafted wireless management frame to disclose sensitive information.

The issue is reachable from at76_rx_tasklet() while scanning.

609) Out-of-bounds read (CVE-ID: CVE-2026-68376)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in sctp_auth_get_hmac() when processing SCTP authentication parameters during association initialization. A local user can configure four HMAC identifiers to trigger memory corruption that leads to an out-of-bounds read and disclose sensitive information.

The issue stems from an undersized auth_hmacs array in struct sctp_cookie that can corrupt the adjacent auth_chunks field and cause an invalid HMAC identifier to be accepted.

610) Use-after-free (CVE-ID: CVE-2026-68377)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in tunnel_key_release_params() in net/sched/act_tunnel_key.c when handling concurrent tunnel key action processing on the datapath. A local user can trigger a race condition to cause a denial of service.

The issue arises because a reader may still access the old params structure under RCU while the associated metadata_dst is released synchronously.

611) Use-after-free (CVE-ID: CVE-2026-68381)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a use-after-free in async oplock and lease break notification handling in fs/smb/server/oplock.c when processing asynchronous oplock break notifications during connection teardown. A remote user can trigger a race condition to cause a denial of service.

Exploitation requires a race between connection teardown and an oplock or lease break notification.

612) Improper input validation (CVE-ID: CVE-2026-68386)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state validation in sockmap update handling in net/core/sock_map.c when processing updates for unhashed UDP sockets. A local user can use a BPF program to look up an unbound UDP socket and then bind the socket to trigger a refcount imbalance and cause a denial of service.

The issue is triggered by a transition of a UDP socket from an unbound state to a bound state, which causes the reference decrement to be skipped and results in a memory leak.

613) Out-of-bounds read (CVE-ID: CVE-2026-68388)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in smb3_simple_fallocate_range() when handling server-reported allocated ranges during fallocate operations. A local user can trigger fallocate on an SMB client mount backed by a server that returns overlapping or malformed allocated ranges to cause a denial of service.

A later write to a skipped hole may fail with ENOSPC.

614) Use-after-free (CVE-ID: CVE-2026-68389)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in qca_controller_memdump() in the Qualcomm Bluetooth hci_qca driver when processing a controller-reported memdump with an invalid zero dump size. A local user can trigger a crafted invalid memdump condition to cause a denial of service.

The issue can leave memdump collection state stale and IBS disabled after the aborted dump, which may block waiters or later transmit handling.

615) Use-after-free (CVE-ID: CVE-2026-68391)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Bluetooth management subsystem in net/bluetooth/mgmt.c when handling Bluetooth management operations involving pending command callbacks and connection lookups. A local user can trigger connection state changes during these operations to cause a denial of service.

The issue involves dereferencing RCU-protected hci_conn pointers outside critical sections and accessing connection state without the required device lock, which can also lead to a data race.

616) Use-after-free (CVE-ID: CVE-2026-68392)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Bluetooth management subsystem net/bluetooth/mgmt.c when handling unpair and disconnect operations. A local user can trigger these operations to cause a denial of service.

The issue arises from dereferencing RCU-protected connection pointers outside the required critical section.

617) Improper Initialization (CVE-ID: CVE-2026-68395)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper initialization in the sata_dwc_460ex driver interrupt handling during device probe when enabling SATA interrupts before the IRQ handler is registered. A local attacker can trigger an interrupt during probe or cause a probe failure after interrupts are unmasked to cause a denial of service.

The issue can result in a spurious interrupt storm if the controller asserts an interrupt with no registered handler.

618) Race condition (CVE-ID: CVE-2026-68396)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the SCSI error handling logic when scheduling the error handler while commands are timed out or inactive. A local user can trigger error-handling conditions to cause a denial of service.

The issue can prevent the error handler thread from waking.

619) Use-after-free (CVE-ID: CVE-2026-68397)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in afiucv_hs_rcv() and the afiucv_hs_callback_* handlers when processing AF_IUCV socket traffic. A local user can trigger a concurrent socket close to cause a denial of service.

The issue arises because the destination socket is looked up under a lock and then used after the lock is released without holding a reference.

620) Use-after-free (CVE-ID: CVE-2026-68398)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a use-after-free in pppol2tp_recv() and PPP channel handling when processing pppol2tp receive traffic concurrently with channel teardown. A local user can trigger concurrent receive and close operations to cause a denial of service or execute arbitrary code.

The issue is reachable by an unprivileged user and affects a channel that is bound but not attached to a PPP unit and not bridged.

621) Use-after-free (CVE-ID: CVE-2026-68399)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in sk_clone() and BPF socket local storage handling when cloning sockets and an early bailout occurs before BPF storage cloning. A local user can trigger socket cloning that fails before storage initialization completes to cause a denial of service.

Only systems with BPF syscall support enabled are vulnerable.

622) Out-of-bounds read (CVE-ID: CVE-2026-68402)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in cfg80211_is_element_inherited() when parsing a crafted wireless frame containing a zero-length extension element. A remote attacker can send a specially crafted frame to disclose sensitive information.

The issue is triggered during element parsing when a non-inheritance context exists, such as while parsing a per-STA profile of a Multi-Link element in a (re)association response or a non-transmitted BSS profile.

623) Improper Initialization (CVE-ID: CVE-2026-68403)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper initialization in brcmf_sdio_probe() and brcmf_sdio_remove() when handling an early probe failure during SDIO device initialization. A local attacker can trigger a workqueue allocation failure to cause a denial of service.

The issue occurs because the cleanup path cancels bus->datawork before the work item has been initialized.

624) Improper locking (CVE-ID: CVE-2026-68405)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in ieee80211_do_stop() for AP_VLAN packet cleanup when freeing queued SKBs associated with ps->bc_buf while IRQs are disabled. A local user can trigger AP_VLAN stop processing with buffered packets to cause a denial of service.

The issue occurs because ieee80211_free_txskb() may invoke reporting paths beyond passive SKB release while the IRQ-disabled lock is still held.

625) Improper input validation (CVE-ID: CVE-2026-68406)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in PMSR FTM request parsing in cfg80211/nl80211 when processing user-supplied PMSR FTM request attributes. A remote attacker can send a specially crafted request with an out-of-range preamble value to cause a denial of service.

626) Memory leak (CVE-ID: CVE-2026-68407)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in nl80211_parse_beacon() when processing beacon data with fewer RNR entries than MBSSID entries. A local user can supply crafted beacon data to cause a denial of service.

627) Deadlock (CVE-ID: CVE-2026-68408)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock in cfg80211 PMSR work handling when closing a netlink socket that owns a PMSR session concurrently with interface teardown. A local user can close the socket and trigger concurrent interface shutdown processing to cause a denial of service.

The deadlock is also reachable from cfg80211_leave_locked() when interface cleanup is performed under wiphy_lock.

628) Memory leak (CVE-ID: CVE-2026-68410)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in helper_firmware_cb() in the libertas USB firmware-download path when handling an asynchronous firmware load. A local user can trigger the firmware-download path to cause a denial of service.

No runtime testing was performed because compatible Libertas USB hardware was unavailable.

629) Out-of-bounds write (CVE-ID: CVE-2026-68411)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in hwsim_virtio_rx_work() when processing a virtio RX length reported by the device. A remote attacker can report an oversized length value to cause a denial of service.

The issue can trigger skb_over_panic() and panic the guest system.

630) Improper resource shutdown or release (CVE-ID: CVE-2026-68413)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in ipw2100_pci_init_one() when handling error paths during device initialization. A local attacker can trigger initialization failures to cause a denial of service.

631) Use-after-free (CVE-ID: CVE-2026-68414)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in cfg80211_sched_scan_results_wk when processing scheduled scan result work during device unregister. A local user can trigger scheduled scan result handling during interface teardown to cause a denial of service.

The issue is caused by a race condition between the scheduled-scan result path and the unregister/free path.

632) Double free (CVE-ID: CVE-2026-68416)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in add_mtd_device() error handling for MTD partitions when handling device registration or nvmem provider initialization failures. A local user can trigger a failure in these error paths to cause a denial of service.

The issue also causes a WARN_ON condition because the partition node remains linked in the parent's partitions list when the release callback is invoked.

633) Race condition (CVE-ID: CVE-2026-68417)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in siw_create_qp() and QP lookup handling when creating and looking up queue pairs. A local user can trigger a QPN lookup for a queue pair that is still being constructed to cause a denial of service.

The issue occurs because the queue pair can be published before its queues, completion queue pointers, state, completion object, and device list entry are fully initialized.

634) Improper access control (CVE-ID: CVE-2026-68419)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access control in irdma_rereg_user_mr when re-registering non-memory regions. A local user can invoke rereg_mr on a specially registered QP, CQ, or SRQ region to cause a denial of service.

The issue affects special RDMA registrations created through a two-step userspace allocation and registration process where the region does not have a valid mkey.

635) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-68422)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a missing release of a reference in merge_reloc_roots() in the btrfs relocation code when handling an unexpected reloc_root for a root. A local user can trigger this condition to cause a denial of service.

The issue results in a root reference leak.

636) Improper input validation (CVE-ID: CVE-2026-68425)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state validation in the kernel-handled RMPP receive processing in IB MAD handling when processing unsolicited active RMPP DATA responses. A remote attacker can send a specially crafted unmatched RMPP response to cause a denial of service.

The issue occurs because receive-side reassembly could begin before the full TID and source address were verified against an outstanding send.

637) Use-after-free (CVE-ID: CVE-2026-68427)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in host1x_bo_clear_cached_mappings() when clearing cached mappings. A local user can trigger the vulnerable code path to cause a denial of service.

638) Use-after-free (CVE-ID: CVE-2026-68428)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the KVM x86 MMU cache cleanup logic when reloading a vendor module after a prior unload. A local user can trigger a vendor module reload sequence with a failed cache initialization to cause a denial of service.

The issue occurs when kvm.ko remains loaded while a vendor module is unloaded and then reloaded, leaving a stale cache pointer that is later passed to kmem_cache_destroy().

639) Race condition (CVE-ID: CVE-2026-68429)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in drm_dp_mst_topology_queue_probe() when handling hotplug or link-loss events during MST topology teardown. A local user can trigger concurrent monitor connect or disconnect activity to cause a denial of service.

The issue can lead to spurious kernel warnings and compositor crashes when connecting or disconnecting DP MST monitors.

640) Reachable assertion (CVE-ID: CVE-2026-68430)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a reachable assertion in the amdgpu gfx8 fence emission logic when processing GPU fence operations. A local user can trigger the affected code path to cause a denial of service.

The issue results in a kernel crash.

641) Out-of-bounds read (CVE-ID: CVE-2026-68431)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ksmbd connection request handling when processing short SMB2 transform requests on an SMB 2.1 connection. A remote attacker can send a specially crafted truncated transform packet to disclose sensitive information.

The issue occurs when a transform packet is accepted even though the negotiated dialect does not provide transform handling.

642) Improper access control (CVE-ID: CVE-2026-68432)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify VXLAN device configuration across network namespaces.

The vulnerability exists due to improper access control in vxlan_changelink() when handling changelink requests for a VXLAN device whose underlay network namespace differs from the device network namespace. A local privileged user can send a crafted changelink request to modify VXLAN device configuration across network namespaces.

The issue occurs when the caller has CAP_NET_ADMIN in the device network namespace but not in the VXLAN underlay network namespace.

643) Out-of-bounds read (CVE-ID: CVE-2026-68433)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in handle_get_version_reply() in libceph when processing a truncated MON_GET_VERSION_REPLY message. A remote attacker can send a specially crafted reply to disclose sensitive information.

The issue occurs because decoding is bounded by the reused reply buffer size rather than the number of bytes actually received, allowing stale tail bytes from an earlier message to be read.

644) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68437)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the pvr_queue_prepare_job() and paired fragment job handling in the drm/imagination PowerVR queue logic when processing paired geometry and fragment jobs. A local user can submit crafted paired jobs to cause a denial of service.

The issue can lead to kernel warnings and job timeouts because the code may check CCCB space in the geometry queue instead of the fragment queue and then fail to write the full command sequence.

645) NULL pointer dereference (CVE-ID: CVE-2026-68439)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in mt7925_mcu_bss_he_tlv() when handling HE BSS configuration data. A local user can trigger the vulnerable code path to cause a denial of service.

646) Use-after-free (CVE-ID: CVE-2026-68442)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service and execute arbitrary code.

The vulnerability exists due to use-after-free in btrfs_drop_extent_map_range() and btrfs_free_extent_map() when splitting extent maps during logging. A local user can trigger crafted filesystem activity to cause a denial of service and execute arbitrary code.

The issue is caused by split extent maps incorrectly inheriting EXTENT_FLAG_LOGGING and later being freed while still linked on the inode's modified_extents list.

647) Use-after-free (CVE-ID: CVE-2026-68443)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to execute arbitrary code.

The vulnerability exists due to a use-after-free in the gigabyte_waterforce driver probe path when handling device initialization failure after device I/O has been started. A local attacker can trigger the race condition during probe failure to execute arbitrary code.

The issue is caused by a race condition between hid_input_report() and execution immediately following hid_device_io_start() in the probe function.

648) NULL pointer dereference (CVE-ID: CVE-2026-68444)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in ffa_partition_info_get() when processing a NULL partition UUID argument. A local attacker can trigger the vulnerable function with a NULL argument to cause a denial of service.

The issue results in a kernel panic.

649) Improper access control (CVE-ID: CVE-2026-68445)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass shader validation and execute untrusted GPU shader code.

The vulnerability exists due to improper access control in vc4_gem_object_mmap() when handling mappings of validated shader buffer objects. A local user can map a validated shader buffer object read-only and then use mprotect() to make it writable to bypass shader validation and execute untrusted GPU shader code.

The issue affects validated shader buffer objects that are initially mapped read-only but can later be upgraded to writable mappings.

650) Improper input validation (CVE-ID: CVE-2026-68446)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in vmw_gb_surface_define_internal when handling a userspace surface creation request with a crafted array_size value. A local user can submit a specially crafted request to cause a denial of service.

The array_size limit depends on which Shader Model is available.

651) Infinite loop (CVE-ID: CVE-2026-68449)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an infinite loop in the NCQ tag completion bit-scanning logic in sata_dwc_isr() in drivers/ata/sata_dwc_460ex.c when processing NCQ tag completion data with only high bits set in the tag mask. A local attacker can trigger this condition to cause a denial of service.

The issue can occur in hardirq context while a spinlock is held.

652) Memory leak (CVE-ID: CVE-2026-68450)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in __add_reloc_root() in fs/btrfs/relocation.c when inserting a relocation root into reloc_root_tree and encountering an unexpected duplicate entry. A local user can trigger the duplicate insert path to cause a denial of service.

This issue occurs because a newly allocated mapping node is left unfreed if insertion finds an existing entry and returns -EEXIST.

653) Improper input validation (CVE-ID: CVE-2026-68451)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in cca_ecc2protkey() when processing CCA ECC private key requests. A local user can supply a crafted key token with an oversized length field to cause a denial of service.

654) Improper input validation (CVE-ID: CVE-2026-68452)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in cca_cipher2protkey() when processing CCA AES cipher key requests. A local user can supply a key token with an excessive length field to cause a denial of service.

The copy length for the CPRB parameter block is derived directly from the length field in the key token.

655) NULL pointer dereference (CVE-ID: CVE-2026-68454)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a null page reference in kvm_s390_pci_aif_enable() in the KVM s390 PCI code when registering IRQs without a summary bit specified. A local user can request IRQ registration without an AISB to cause a denial of service.

The issue is triggered when a guest enables adapter interruption forwarding without specifying a summary bit.

656) Race condition (CVE-ID: CVE-2026-68456)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a race condition in the ueagle-atm USB driver disconnect handler when handling device removal during asynchronous pre-firmware loading. A local attacker can unplug a device while firmware loading is still in progress to cause a denial of service.

The issue is associated with the firmware sysfs fallback mechanism and manifests when device teardown runs concurrently with the asynchronous firmware request.

657) Improper access control (CVE-ID: CVE-2026-68457)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass intended file permission checks.

The vulnerability exists due to improper access control in ksmbd FSCTL mutation handlers when processing SET_SPARSE, SET_ZERO_DATA, or SET_COMPRESSION operations on an open SMB handle. A remote user can invoke these operations so they are performed with ksmbd worker credentials to bypass intended file permission checks.

The issue arises because helper calls may independently revalidate inode permissions, ownership, or LSM policy instead of relying solely on the SMB handle access mask.

658) Deadlock (CVE-ID: CVE-2026-68459)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in f2fs_balance_fs() gc_merge path when handling filesystem writeback and foreground garbage collection. A local user can trigger filesystem activity that causes a deadlock to cause a denial of service.

Only systems mounted with the gc_merge option are vulnerable.

659) Deadlock (CVE-ID: CVE-2026-68460)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock condition in f2fs_balance_fs() when handling writeback and garbage collection on nearly exhausted f2fs filesystem space. A local user can trigger filesystem write activity to cause a denial of service.

The issue occurs when the f2fs filesystem space is nearly exhausted.

660) Use of Uninitialized Variable (CVE-ID: CVE-2026-68461)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use of uninitialized memory in fwnode_init() in the firmware node handling code when initializing a fwnode_handle allocated on the stack or with a non-zeroing heap allocation. A local user can trigger dereference of an uninitialized secondary pointer to cause a denial of service.

Exploitation requires control over the lifetime and initialization context of the firmware node object.

661) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-68466)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in the lpc32xx_xmit_dma() function when waiting for DMA transfer completion. A local user can trigger a DMA completion timeout to cause a denial of service.

The timed out transfer may continue accessing the buffer after an error condition occurs.

662) Improper Initialization (CVE-ID: CVE-2026-68467)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in the mchp23k256 SPI flash driver when probing id-table-only SPI device matches. A local user can attach or register a device that matches through the SPI id table to cause a denial of service.

The issue occurs because the driver may use incorrect chip capacity data and wrong MTD geometry for non-OF SPI modalias matches.

663) Race condition (CVE-ID: CVE-2026-68469)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in mwifiex_ret_802_11_associate() in the mwifiex wireless driver when processing an association command response during roaming. A local user can trigger repeated roam or connection changes to cause a denial of service.

The issue can leave scan requests permanently busy so later userspace scan requests fail with -EBUSY. The behavior was observed on IW412 firmware when power-save sleep events coincided with association handling.

664) Out-of-bounds read (CVE-ID: CVE-2026-68474)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in spufs_mem_mmap_access() when accessing the SPU local store through a memory-mapped area. A local user can supply a crafted offset and length to read beyond the LS_SIZE buffer and disclose sensitive information.

The issue affects 64-bit systems because the existing clamp does not properly limit access against the local store size.

665) Improper resource shutdown or release (CVE-ID: CVE-2026-68475)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a resource leak.

The vulnerability exists due to improper resource shutdown or release in sunxi_reset_init() in the sunxi reset driver when handling an ioremap() failure. A local user can trigger initialization that causes ioremap() to fail to cause a resource leak.

666) Use-after-free (CVE-ID: CVE-2026-68476)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in __ip_vs_get_out_rt() handling of skb head reallocation in net/netfilter/ipvs/ip_vs_xmit.c when processing packets in ip_vs_bypass_xmit(). A local user can trigger skb head reallocation and subsequent use of a stale IP header pointer to cause a denial of service.

667) Improper input validation (CVE-ID: CVE-2026-68477)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incorrect packet processing.

The vulnerability exists due to improper handling of ipv6 transport offsets in ipvs application and icmpv6 response processing when handling ipv6 packets with extension headers. A remote attacker can send specially crafted ipv6 traffic to cause incorrect packet processing.

The issue affects TCP application handling and ICMPv6 checksum validation in IPVS for IPv6 traffic.

668) Out-of-bounds write (CVE-ID: CVE-2026-68478)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to corrupt memory.

The vulnerability exists due to an out-of-bounds write in the ms_block Memory Stick block translation layer when processing a Memory Stick card that reports an excessive number of blocks. An attacker with physical access can provide a crafted card with a block count above the supported maximum to corrupt memory.

The issue occurs because the card-supplied block count can cause indexing past the end of the fixed free_block_count array.

669) Integer underflow (CVE-ID: CVE-2026-68479)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer underflow leading to out-of-bounds read and out-of-bounds write in rtlbt_parse_firmware() when parsing a malformed Bluetooth firmware patch during Bluetooth setup. A local user can supply a specially crafted firmware patch to cause a denial of service.

The issue can be triggered by a firmware patch shorter than the version field, and arithmetic wraparound may affect 32-bit architectures.

670) Insufficient Control Flow Management (CVE-ID: CVE-2026-68480)

CWE-ID: CWE-691 - Insufficient Control Flow Management

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper control flow handling in the x86 Safe-RET sequence when interrupts are injected during execution of the sequence on SRSO-affected systems. A local user can inject interrupts during the Safe-RET sequence to disclose sensitive information.

Only systems affected by SRSO are vulnerable.

671) Memory leak (CVE-ID: CVE-2026-72004)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in ieee80211_register_hw() when copying supported band structures. A local user can trigger hardware registration with memory allocation failure conditions to cause a denial of service.

The issue occurs on an error path after rate control has been initialized.

672) Improper Initialization (CVE-ID: CVE-2026-72005)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in rt2x00lib_probe_dev() and rt2x00lib_remove_dev() when handling probe failures before work items are initialized. A local user can trigger an early probe failure to cause a denial of service.

The issue occurs when drv_data or workqueue allocation fails before intf_work, autowakeup_work, and sleep_work have been set up.

673) Improper locking (CVE-ID: CVE-2026-72007)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a timing issue in the imx8m block control power-on sequence for VC8000E when powering up the VC8000E domain. A local user can trigger power up and down cycling to cause a denial of service.

The issue is associated with the i.MX8MP VC8000E and VPU_NOC power down handshake, which may hang during power state cycling.

674) Division by zero (CVE-ID: CVE-2026-72010)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to division by zero in mpol_relative_nodemask in the cpuset mempolicy rebind path when handling a CPU hotplug event for a task in a child cpuset with an unset cpuset.mems and a VMA mempolicy using MPOL_F_RELATIVE_NODES. A local user can create such a cpuset configuration and trigger CPU hotplug handling to cause a denial of service.

Exploitation requires a child cpuset where cpuset.mems is not set and a VMA mempolicy configured with MPOL_F_RELATIVE_NODES.

675) Use-after-free (CVE-ID: CVE-2026-72012)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the osnoise tracer instance unregistration logic when unregistering an osnoise tracing instance while RCU readers are traversing the instance list. A local user can trigger instance unregistration to cause a denial of service.

676) NULL pointer dereference (CVE-ID: CVE-2026-72013)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in machine_kexec_prepare() when processing kexec image segments. A local user can provide a kexec image segment with a NULL buffer pointer to cause a denial of service.

The issue occurs in the RISC-V kexec path during handling of segments prepared through kexec_file_load().

677) Out-of-bounds write (CVE-ID: CVE-2026-72014)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt kernel memory.

The vulnerability exists due to an out-of-bounds write in recv_dless_read() when processing a crafted P_DATA_REPLY from a DRBD peer. A remote attacker can send a specially crafted data reply to corrupt kernel memory.

A node that reads from its peer, such as a diskless node or a node using read-balancing to the peer, is exposed in the default configuration. A man-in-the-middle DRBD peer can also exploit the issue.

678) Double free (CVE-ID: CVE-2026-72015)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in RMID management in fs/resctrl/rdtgroup.c when unmounting and removing pseudo-locked resctrl groups. A local user can create a pseudo-locked group and trigger unmount processing to cause a denial of service.

The issue affects pseudo-locked groups whose RMID is freed during setup and then freed again during cleanup.

679) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-72017)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in the macb driver transmit queue handling when closing the network device. A local user can trigger device close operations while transmit SKBs remain in flight to cause a denial of service.

The issue affects outgoing SKBs that have not yet been marked as completed and are stored in queue->tx_skb.

680) Out-of-bounds read (CVE-ID: CVE-2026-72019)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in macsec_encrypt() when processing packets transmitted through the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS path with an unset MAC header. A local user can send a specially crafted packet to disclose sensitive information.

The 12-byte heap over-read may be emitted on the wire as the frame's outer source and destination MAC addresses.

681) Use of Uninitialized Variable (CVE-ID: CVE-2026-72020)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information and corrupt forwarded TCP traffic.

The vulnerability exists due to use of uninitialized memory in ip_vs_conn_new and TCP sequence handling in IPVS when processing a malformed sync message that omits sequence data. A remote user can send a specially crafted sync message to disclose sensitive information and corrupt forwarded TCP traffic.

The issue affects connections learned from a sync message when sequence flags are preserved without valid sequence data, causing stale slab bytes to be used in TCP sequence and acknowledgment number rewriting by an IPVS application helper.

682) Incorrect calculation (CVE-ID: CVE-2026-72021)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incorrect connection state tracking.

The vulnerability exists due to improper calculation of buffer offsets in SCTP state lookup in net/netfilter/ipvs/ip_vs_proto_sctp.c when processing IPv6 SCTP packets with extension headers. A remote attacker can send a specially crafted IPv6 SCTP packet with extension headers to cause incorrect connection state tracking.

This can cause an SCTP connection to be moved to the established state before the SCTP handshake has completed, resulting in incorrect timeout handling and destination counter updates.

683) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-72022)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a reference count leak in llc_ui_autobind() when repeatedly autobinding and closing LLC sockets. A local user can perform repeated autobind and close cycles to cause a denial of service.

The issue can consume all dynamic SAP values, causing subsequent autobind operations to fail with -EUSERS.

684) Memory leak (CVE-ID: CVE-2026-72023)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in otx2_init_hw_resources() and the SQ resource unwind path when handling initialization failures. A local user can trigger an initialization failure to cause a denial of service.

Exploitation requires access to a system using the OcteonTX2 PF driver.

685) Race condition (CVE-ID: CVE-2026-72024)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the mac802154 interface removal logic when handling asynchronous transmit completion during interface teardown. A local user can trigger interface removal while transmit completion paths access the interface list to cause a denial of service.

The issue arises because queue wake, stop, and disable paths walk local->interfaces under RCU while bulk hardware teardown removes interface entries.

686) Out-of-bounds write (CVE-ID: CVE-2026-72025)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in the monwriter misc device when reusing data buffers with a different data length. A local user can submit crafted records with a changed data length to cause memory corruption.

By default, access to the device is restricted to root-only permissions.

687) Improper Initialization (CVE-ID: CVE-2026-72028)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in arch/riscv/kernel/probes/rethook_trampoline.S when handling kretprobe stack access on risc-v systems. A local user can configure a kretprobe that reads a word from the stack to cause a denial of service.

The issue occurs because the original stack pointer is not preserved in the saved register state, which can leave regs->sp with an arbitrary value during stack access.

688) Out-of-bounds read (CVE-ID: CVE-2026-72029)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information and cause a denial of service.

The vulnerability exists due to an out-of-bounds read and improper validation of device-supplied offsets and lengths in mux_dl_adb_decode() in the iosm MUX downlink decoder when processing modem-supplied aggregated datagram tables in a received skb. A local attacker can provide crafted offset and length values to trigger out-of-bounds reads and an infinite loop to disclose sensitive information and cause a denial of service.

The issue can be triggered by a modem that supplies malformed table and datagram metadata after the iosm net device is up, and the loop runs in softirq while cloning the skb on each pass.

689) Out-of-bounds write (CVE-ID: CVE-2026-72030)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to out-of-bounds read and out-of-bounds write in ata_dev_config_cpr() and the VPD page B9h emitter when processing a device-reported concurrent positioning ranges log. An attacker with physical access can connect a crafted device that reports an invalid concurrent positioning ranges count to cause a denial of service.

The issue can affect both parsing of the returned log data and emission of one descriptor per range into a fixed-size response buffer.

690) Out-of-bounds read (CVE-ID: CVE-2026-72033)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in fill_from_part() in the OrangeFS directory handling code when processing a crafted readdir entry trailer supplied by a userspace client. A local user can supply a crafted directory entry with a wrapped length value to cause a denial of service.

The issue occurs because a directory entry size computed in size_t is truncated to a 32-bit value, which can bypass a bounds check and lead to a read far past the directory part.

691) NULL pointer dereference (CVE-ID: CVE-2026-72035)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the sch_taprio scheduler when processing ordinary egress through a non-work-conserving child qdisc after a peeked packet is orphaned and queue state is desynchronized. A local attacker can trigger network egress through a qfq child to cause a denial of service.

The issue can panic the kernel from softirq, and the qfq child can be re-entered on an emptied list.

692) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-72036)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in multiq_dequeue in the sch_multiq scheduler when handling queued packets after a peek operation on a non-work-conserving child qdisc. A local user can trigger network traffic through the affected queuing path to cause a denial of service.

The issue can desynchronize the child queue length and backlog accounting and lead to a NULL pointer dereference in softirq context on egress.

693) Use of uninitialized resource (CVE-ID: CVE-2026-72037)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use of an uninitialized resource in lan743x_hardware_init() and lan743x_hs_syslock_acquire() when probing the device and reading strap status. A local user can trigger device initialization to cause a denial of service.

This issue can trip the spinlock debug check when CONFIG_DEBUG_SPINLOCK is enabled.

694) Improper resource shutdown or release (CVE-ID: CVE-2026-72038)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in setup_cn23xx_octeon_pf_device() in drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c when handling a PF number lookup failure during device initialization. A local user can trigger the affected initialization path to cause a denial of service.

695) Memory leak (CVE-ID: CVE-2026-72039)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in bnx2x_alloc_mem_bp() when handling allocation failures for fp[i].tpa_info. A local user can trigger allocation failure conditions to cause a denial of service.

696) Improper resource shutdown or release (CVE-ID: CVE-2026-72040)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in i_ipmi_request() in the IPMI message handler when handling a request with a caller-supplied recv_msg and an error occurs. A local user can trigger an error path using a supplied receive message to cause a denial of service.

The issue occurs because the reference count on the associated user object remains elevated on certain error paths.

697) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72041)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in espintcp_sendskmsg_locked in net/xfrm/espintcp.c when handling partial sends of sk_msg data. A local user can trigger partial send conditions to cause a denial of service.

698) Improper access control (CVE-ID: CVE-2026-72045)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in rvu_mbox_handler_lmtst_tbl_setup() when handling mailbox requests that specify base_pcifunc. A remote user can supply a crafted base_pcifunc value to disclose sensitive information.

Exploitation requires a VF caller on cn10k hardware, and the issue is limited to redirecting LMTLINE sharing outside the caller's own PF.

699) Type conversion (CVE-ID: CVE-2026-72047)

CWE-ID: CWE-704 - Type conversion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper pointer size handling in the ca8210 debugfs test interface when exchanging kmalloc'd buffer pointers through a kfifo on 64-bit systems. A local user can interact with the debugfs test interface to cause a denial of service.

Only 64-bit builds with CONFIG_IEEE802154_CA8210_DEBUGFS enabled are vulnerable.

700) Memory leak (CVE-ID: CVE-2026-72048)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a memory leak in ca8210_spi_transfer() in the ca8210 IEEE 802.15.4 driver when submitting asynchronous SPI transfers. A local attacker can trigger spi_async() submission failures to cause a denial of service.

Repeated retry attempts under sustained SPI bus contention can leak a new allocation on each occurrence.

701) Improper access control (CVE-ID: CVE-2026-72049)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in the legacy IEEE802154_NL generic netlink LLSEC dump operations when handling LLSEC_LIST_KEY dump requests. A local user can issue a crafted generic netlink dump request to disclose sensitive information.

The issue exposes the raw 16-byte AES-128 LLSEC key bytes for any wpan netdev that has an administrator-installed LLSEC key.

702) Improper access control (CVE-ID: CVE-2026-72051)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify tunnel configuration across network namespaces.

The vulnerability exists due to improper access control in ip6_tnl_changelink() when handling changelink requests for IPv6 tunnel devices across network namespaces. A local privileged user can send a crafted netlink changelink request to modify tunnel configuration across network namespaces.

The issue occurs when the device network namespace differs from the tunnel link network namespace.

703) Improper access control (CVE-ID: CVE-2026-72052)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to modify tunnel link configuration across network namespaces.

The vulnerability exists due to improper access control in ip6gre_changelink() and ip6erspan_changelink() when handling changelink requests for devices and tunnel links in different network namespaces. A remote privileged user can send a crafted changelink request to modify tunnel link configuration across network namespaces.

The issue occurs when the device network namespace differs from the tunnel link network namespace, causing capability checks to be applied only to the device namespace.

704) Improper access control (CVE-ID: CVE-2026-72053)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify IPIP tunnel configuration in another network namespace.

The vulnerability exists due to improper access control in ipip_changelink() in net/ipv4/ipip.c when handling changelink requests for an IPIP device whose tunnel link resides in a different network namespace. A local privileged user can send a changelink request from a network namespace where they have CAP_NET_ADMIN to modify IPIP tunnel configuration in another network namespace.

The issue occurs when dev_net(dev) and the tunnel link namespace differ, such as after the device is created in or moved to a different network namespace.

705) Improper access control (CVE-ID: CVE-2026-72054)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify tunnel configuration across network namespaces.

The vulnerability exists due to improper access control in vti_changelink() in the ip_vti component when handling changelink requests for a tunnel whose link network namespace differs from the device network namespace. A local privileged user can send a changelink request to modify tunnel configuration across network namespaces.

The issue occurs when the device is created in or moved to a different network namespace than the one from which the request is issued.

706) Improper access control (CVE-ID: CVE-2026-72055)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify tunnel configuration across network namespaces.

The vulnerability exists due to improper access control in vti6_changelink() in the ip6_vti component when handling changelink requests for a tunnel device associated with another network namespace. A local privileged user can send a changelink request from a namespace where they hold CAP_NET_ADMIN to modify tunnel configuration across network namespaces.

The issue arises when the device network namespace and the tunnel link network namespace differ.

707) Improper resource shutdown or release (CVE-ID: CVE-2026-72056)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in ena XDP TX queue handling in the ena network driver when setting up regular TX queues after XDP TX queues have already been created. A local user can trigger regular TX setup failures to cause a denial of service.

The issue occurs in error-handling paths that omit teardown of previously created XDP TX queues.

708) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72057)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper preservation of control-buffer state in tcf_ct_handle_fragments() in the act_ct component when handling fragmented traffic through connection-tracking defragmentation. A remote attacker can send specially crafted fragmented packets to cause a denial of service.

System impact occurs when panic_on_warn is enabled.

709) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72058)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in ixp4xx_hss_probe() when allocating and registering HDLC netdev objects. A local user can trigger device initialization and removal to cause a denial of service.

The issue stems from allocating two different netdev objects and later unregistering and freeing a different object than the one that was registered.

710) Improper resource shutdown or release (CVE-ID: CVE-2026-72059)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in t7xx_cldma_late_init() in the t7xx WWAN CLDMA driver when handling late initialization failures during TX and RX ring setup. A local user can trigger a ring initialization failure to cause a denial of service.

711) Improper access control (CVE-ID: CVE-2026-72061)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify tunnel configuration across network namespaces.

The vulnerability exists due to improper access control in ipip6_changelink() in the sit tunnel handler when handling changelink requests for a tunnel whose link network namespace differs from the device network namespace. A local privileged user can send a changelink request to modify tunnel configuration across network namespaces.

The issue occurs when the caller has CAP_NET_ADMIN in the device network namespace but not in the tunnel link network namespace.

712) Race condition (CVE-ID: CVE-2026-72062)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in mediatek_gpio_irq_type() when handling concurrent IRQ type configuration on GPIOs in the same bank. A local user can trigger concurrent configuration changes to corrupt shared interrupt trigger state and cause a denial of service.

The issue affects bank-shared interrupt trigger fields such as rising and falling because each GPIO chip instance represents an entire bank of 32 pins.

713) Improper locking (CVE-ID: CVE-2026-72063)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper interaction with a mutex in tegra_gpio_direction_input() and tegra_gpio_direction_output() when changing GPIO direction on shared GPIO lines. A local user can trigger GPIO direction operations while a per-line spinlock is held to cause a denial of service.

The issue can lead to sleeping in an atomic context.

714) Stack-based buffer overflow (CVE-ID: CVE-2026-72066)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in states_show() in kernel/cpu.c when generating sysfs output for CPU hotplug states. A local user can read the affected sysfs entry to cause a denial of service.

715) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-72067)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in cpuhp_invoke_callback() when unwinding earlier callbacks for the same hotplug state after an instance callback failure. A local user can trigger a CPU hotplug state transition failure to cause a denial of service.

716) Integer overflow (CVE-ID: CVE-2026-72068)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer truncation in update_rlimit_cpu() when converting the RLIMIT_CPU value to nanoseconds on 32-bit kernels. A local user can set a CPU time limit of 5 seconds or more to cause a denial of service.

Only 32-bit kernels are affected. Limit enforcement remains correct, but the process CPU timer may be programmed to fire prematurely.

717) Use-after-free (CVE-ID: CVE-2026-72069)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in rt_spin_unlock(), rt_read_unlock(), and rt_write_unlock() when releasing RCU protection before completing unlock operations. A local user can trigger concurrent lock and RCU operations to execute arbitrary code.

The issue affects the RT spinlock and rwlock substitutions where unlock handling does not preserve the expected non-RT RCU protection semantics.

718) Use-after-free (CVE-ID: CVE-2026-72070)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in lbtf_free_adapter() when handling device removal during a firmware command timeout. A local user can trigger concurrent teardown and timer callback execution to cause a denial of service.

719) Use-after-free (CVE-ID: CVE-2026-72071)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in user_event_mm_dup() and the user_events enabler handling in kernel/trace/trace_events_user.c when walking the parent mm enabler list during fork() while an enabler is concurrently unregistered. A local user can register an enabler and then concurrently unregister it and call fork() to cause a denial of service.

Exploitation requires access to open user_events_data and a race between concurrent operations in a multithreaded process.

720) Use-after-free (CVE-ID: CVE-2026-72072)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in mlx5e MACsec RX offload handling when deleting and processing offloaded MACsec RX SC entries concurrently. A local user can trigger concurrent RX SC deletion and RX datapath processing to cause a denial of service.

The issue affects the RX datapath under RCU lookup and reference handling of metadata_dst objects.

721) Type Confusion (CVE-ID: CVE-2026-72074)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to type confusion in the CDC union descriptor parser in the ims-pcu driver when parsing a crafted USB CDC union descriptor. An attacker with physical access can provide a device with a manipulated bMasterInterface0 value to cause a denial of service.

722) Race condition (CVE-ID: CVE-2026-72075)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the ims_pcu_reset_device() sysfs callback when handling concurrent reset_device sysfs requests and other commands. A local user can trigger concurrent sysfs operations to cause a denial of service.

The issue can corrupt a shared command buffer during concurrent access.

723) Out-of-bounds read (CVE-ID: CVE-2026-72076)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in ims_pcu_irq() debug logging when handling a control URB with an actual_length exceeding the input buffer size. A local attacker can trigger the vulnerable debug logging path to disclose sensitive information.

The issue occurs because the debug output reads from the wrong buffer when the interrupt is associated with the control URB.

724) Improper resource shutdown or release (CVE-ID: CVE-2026-72077)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the ims-pcu firmware update handler when processing an asynchronous firmware update. A local user can trigger firmware validation failure to cause a denial of service.

725) Improper input validation (CVE-ID: CVE-2026-72078)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper input validation in the ims-pcu driver control endpoint handling when parsing a malicious USB device interface. An attacker with physical access can provide a crafted device with a non-interrupt IN control endpoint to cause a denial of service.

The issue may lead to kernel warnings or undefined behavior.

726) Use-after-free (CVE-ID: CVE-2026-72079)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to trigger a use-after-free or double-free.

The vulnerability exists due to a use-after-free and double-free in ims_pcu_disconnect() when handling the disconnection of a crafted USB interface. An attacker with physical access can present a malicious device with a data interface masquerading as the control interface to trigger a use-after-free or double-free.

727) Memory leak (CVE-ID: CVE-2026-72081)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in efct_dispatch_fcp_cmd() in the efct SCSI driver when processing an unsolicited FCP command with an unsupported additional CDB. A remote attacker can send a crafted FCP command to cause a denial of service.

728) Improper resource shutdown or release (CVE-ID: CVE-2026-72082)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in efct_hw_io_abort() when handling an I/O abort request after request tag allocation fails. A local user can trigger this error path to cause a denial of service.

The abort_in_progress flag may remain set even though the abort was never submitted, causing subsequent abort attempts for the same I/O to return an in-progress error and block recovery.

729) Use-after-free (CVE-ID: CVE-2026-72083)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a use-after-free in core_scsi3_emulate_pro_register_and_move() when processing a crafted iSCSI TransportID in a PERSISTENT RESERVE OUT REGISTER AND MOVE parameter list. A remote user can send a specially crafted request to cause a denial of service.

The issue is triggered when the parameter list spans more than one page, causing the ISID pointer to reference an unmapped region after the buffer is torn down.

730) Out-of-bounds read (CVE-ID: CVE-2026-72084)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in iSCSI PR-OUT TransportID parsing in the Linux kernel SCSI target subsystem when processing a crafted PERSISTENT RESERVE OUT TransportID buffer. A remote attacker can send a specially crafted PR OUT request to cause a denial of service.

The issue is reachable through any fabric that delivers a PR OUT to a device exported through an iSCSI target portal group, including a guest via vhost-scsi.

731) Use-after-free (CVE-ID: CVE-2026-72085)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a refcount underflow leading to use-after-free in xen-scsiback request handling when processing pvSCSI requests before command submission. A remote user can submit requests with a bad grant reference or an unknown request type to cause a denial of service.

Under panic_on_warn, triggering the refcount underflow can panic the host. The issue can also leak every command tag of a LUN session, stopping the LUN.

732) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-72086)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a resource leak in scsiback_device_action() in the xen scsi backend when submitting task-management requests and handling target_submit_tmr() failures. A remote user can issue VSCSIIF_ACT_SCSI_ABORT or reset requests to cause a denial of service.

The issue affects a pvSCSI guest and can leak command tags for a LUN session, stopping the LUN, when task-management request submission fails.

733) Memory leak (CVE-ID: CVE-2026-72087)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in lpfc_sli4_driver_resource_setup() in the lpfc driver when handling early exit error paths during driver resource setup. A local user can trigger the affected error paths to cause a denial of service.

734) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72088)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in hpsa_scsi_ioaccel2_queue_command() in the hpsa SCSI driver when handling an IOACCEL2 reset condition. A local user can trigger the affected code path to cause a denial of service.

The issue occurs when phys_disk->in_reset is set during command processing.

735) Out-of-bounds read (CVE-ID: CVE-2026-72089)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in fw_log_print_lines() when processing a firmware log with a size smaller than its header. A local user can supply a crafted firmware log to cause a denial of service or disclose sensitive information.

A zero-sized log can cause callers to loop forever on the same header.

736) Race condition (CVE-ID: CVE-2026-72096)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to bypass audit logging of corrupted block errors.

The vulnerability exists due to a race condition in dm-verity error handling in drivers/md/dm-verity-target.c when handling concurrent corrupted block errors. A local attacker can trigger concurrent error conditions to bypass audit logging of corrupted block errors.

737) NULL pointer dereference (CVE-ID: CVE-2026-72097)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in dm_verity_loadpin_is_bdev_trusted when checking whether a block device is trusted. A local attacker can trigger the vulnerable code path to cause a denial of service.

The issue occurs if the device has no table.

738) Incorrect calculation (CVE-ID: CVE-2026-72099)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper calculation in dm-integrity when processing integrity metadata tags. A local user can trigger incorrect hash offset handling to cause a denial of service.

739) Double free (CVE-ID: CVE-2026-72102)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in dm_early_create in drivers/md/dm-ioctl.c when resuming a device-mapper device after swapping in a new table. A local user can trigger a dm_resume failure to cause a denial of service.

740) Integer overflow (CVE-ID: CVE-2026-72105)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in create_log_context in drivers/md/dm-log.c when calculating bitmap memory size for large region_count values on 32-bit systems. A local user can trigger the vulnerable code path to cause a denial of service.

Only 32-bit systems are affected.

741) Heap-based buffer overflow (CVE-ID: CVE-2026-72106)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in list_version_get_info in dm-ioctl when processing ioctl requests. A local user can send a specially crafted ioctl request to cause a denial of service.

742) Out-of-bounds read (CVE-ID: CVE-2026-72107)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in dm-era writeset handling when processing I/O for tables with a non-zero start sector. A local user can trigger out-of-bounds memory access to cause a denial of service.

The issue occurs because an absolute mapped-device block number is used instead of a target-relative block number during writeset lookup.

743) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72108)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause metadata inconsistency and a denial of service.

The vulnerability exists due to improper state management in dm-thin metadata snapshot handling in drivers/md/dm-thin-metadata.c when reserving or releasing a metadata snapshot and a subsequent metadata commit fails. A local user can issue crafted dmsetup messages to trigger a commit failure and cause metadata inconsistency and a denial of service.

Exploitation requires the ability to manage a thin-pool metadata device and trigger snapshot reserve or release operations under commit-failure conditions.

744) Improper resource shutdown or release (CVE-ID: CVE-2026-72109)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper cleanup in sparx5_register_notifier_blocks() in the sparx5 switchdev component when handling initialization failures after workqueue allocation fails. A local user can trigger initialization failure conditions to cause a denial of service.

The issue leaves a switchdev blocking notifier registered on the error path.

745) Use-after-free (CVE-ID: CVE-2026-72110)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a use-after-free in task BPF storage handling in copy_process() and free_task() when handling a fork operation that aborts before task BPF storage is initialized. A local user can trigger a failed fork from a process inserted into a task storage map to cause a denial of service or execute arbitrary code.

Exploitation is reachable when the calling process has been inserted into a task storage map.

746) Improper input validation (CVE-ID: CVE-2026-72111)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass BPF memory safety checks.

The vulnerability exists due to improper register state handling in check_mem_access() in the BPF verifier when processing a context load of an LSM hook return value. A local user can load a hook return value into a register with stale bounds to bypass BPF memory safety checks.

The issue arises from a verifier/runtime mismatch because the verifier may treat the register as having a narrower range than the actual runtime value.

747) Race condition (CVE-ID: CVE-2026-72113)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a missing device reference count in the CAN BCM socket handling code when unregistering CAN filters during concurrent device unregistration. A local user can trigger concurrent socket and device unregistration conditions to cause a denial of service.

The issue can leave a stale CAN filter pointing to a soon-to-be-freed bcm_op or socket.

748) Improper input validation (CVE-ID: CVE-2026-72114)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in bcm_rx_setup() in the CAN BCM subsystem when processing RX_SETUP messages with RX_RTR_FRAME. A local user can supply a crafted RTR-reply frame with an invalid length to cause a denial of service.

The issue affects RTR replies configured through RX_SETUP and involves validation of CAN and CAN FD frame length limits.

749) Race condition (CVE-ID: CVE-2026-72115)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the can bcm rx handler when processing matching frames for an ANYDEV rx operation from multiple interfaces concurrently. A local user can trigger concurrent frame handling to cause a denial of service.

The issue affects ANYDEV rx operations with an active RX timeout and/or throttle timer, and can cause spurious RX_TIMEOUT notifications and corruption of last_frames metadata.

750) Race condition (CVE-ID: CVE-2026-72116)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the net/can/bcm.c CAN broadcast manager rx_ops handling when an RX_SETUP update races with device unregistration. A local user can perform an RX_SETUP update during concurrent device removal to cause a denial of service.

Frame delivery for the updated filter may silently stop for the affected ifindex. This does not apply to rx_ops using ifindex 0 for all CAN devices.

751) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72116)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the net/can/bcm.c CAN broadcast manager tx_ops handling when a CAN device is unregistered while cyclic transmission remains active. A local user can trigger device removal conditions for an existing operation to cause a denial of service.

The issue can leave an hrtimer re-arming indefinitely and may allow injection into a later reused ifindex until an explicit TX_SETUP update occurs.

752) Race condition (CVE-ID: CVE-2026-72117)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose incorrect interface and timestamp metadata to user space.

The vulnerability exists due to a race condition in bcm_rx_handler() when processing CAN frames for rx operations subscribed on all interfaces. A local user can trigger concurrent frame handling on different CPUs to disclose incorrect interface and timestamp metadata to user space.

The issue affects rx operations with ifindex set to 0, where the same operation is registered in the shared per-netns wildcard filter list, and torn 64-bit timestamp stores may occur on 32-bit platforms.

753) Race condition (CVE-ID: CVE-2026-72118)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause incorrect procfs statistics output.

The vulnerability exists due to a race condition in bcm_rx_handler() and related CAN BCM statistics handling in net/can/bcm.c when processing concurrent CAN frame reception on different CPUs for the same rx operation. A local attacker can trigger concurrent CAN frame processing to cause incorrect procfs statistics output.

For rx operations subscribed on all interfaces, concurrent handling on different CPUs can cause frames_filtered to become larger than frames_abs, leading to a bogus or even negative reduction percentage in procfs.

754) Race condition (CVE-ID: CVE-2026-72119)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the net/can/bcm.c CAN BCM transmission handling when updating existing transmit operations from userspace while transmit and timeout processing occur concurrently. A local user can send crafted CAN BCM configuration data to trigger inconsistent frame or timer state and cause a denial of service.

The issue involves partially updated or unvalidated frame data being observable during concurrent transmission processing, and torn 64-bit ktime_t reads on 32-bit platforms.

755) Use-after-free (CVE-ID: CVE-2026-72120)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the net/can/bcm.c broadcast manager operation list handling when traversing and releasing bcm_op structures under RCU protection. A local user can trigger crafted CAN BCM socket operations to cause a denial of service.

The issue involves inconsistent RCU list operations for tx_ops and rx_ops during setup, proc traversal, and socket release.

756) Race condition (CVE-ID: CVE-2026-72121)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in net/can/bcm.c when updating filter and timer values concurrently with handling incoming CAN traffic. A local user can trigger concurrent bcm_rx_setup() and RX handler activity to cause a denial of service.

The issue affects concurrent access to timer, filter, and stored frame state in the broadcast manager CAN implementation.

757) Race condition (CVE-ID: CVE-2026-72122)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause the socket to match traffic from unintended CAN interfaces.

The vulnerability exists due to a race condition in bcm_sendmsg() in net/can/bcm.c when processing CAN BCM socket operations concurrently with device unregistration or concurrent socket binding. A local user can trigger concurrent operations on a shared socket to cause the socket to match traffic from unintended CAN interfaces.

Exploitation requires a race with concurrent bcm_notify() or bcm_connect() updates to the socket state.

758) Use-after-free (CVE-ID: CVE-2026-72123)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the can bcm rx operation handling in net/can/bcm.c when tearing down bcm rx operations concurrently with packet reception and timer activity. A local user can trigger a race condition to cause a denial of service.

The issue involves a thrtimer callback dereferencing a deallocated bcm_op object after an RCU grace period elapses.

759) Race condition (CVE-ID: CVE-2026-72124)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the can isotp socket transmission state machine in net/can/isotp.c when handling concurrent send, receive, echo, timer, and socket release events. A local user can trigger concurrent state transitions to cause a denial of service.

The issue affects TX state handling across sendmsg(), the RX path, and hrtimer callbacks.

760) Use-after-free (CVE-ID: CVE-2026-72125)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free race in the Linux kernel CAN ISO-TP socket handling in net/can/isotp.c when releasing a socket concurrently with NETDEV_UNREGISTER. A local user can trigger concurrent socket release and device unregistration to cause a denial of service.

The issue can leave a stale CAN filter referencing a freed socket.

761) Use-after-free (CVE-ID: CVE-2026-72126)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the isotp socket release and receive timer handling in net/can/isotp.c when processing concurrent CAN ISO-TP socket release and network device unregister events. A local user can trigger the race condition to cause a denial of service.

The issue occurs because an in-flight receive handler may re-arm a timer on a socket that has already been freed.

762) Information disclosure (CVE-ID: CVE-2026-72127)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper access control in netdev_nl_napi_fill_one() when handling NETDEV_CMD_NAPI_GET requests from a child pid namespace. A remote attacker can issue a NETDEV_CMD_NAPI_GET request to disclose sensitive information.

The issue occurs because the reported NAPI kthread PID is returned from the initial pid namespace instead of the caller's pid namespace.

763) Out-of-bounds read (CVE-ID: CVE-2026-72129)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in nvmet_rdma_use_inline_sg() and inline scatterlist handling in the NVMe target RDMA component when processing host-controlled inline data with a nonzero offset. A remote user can send crafted inline data offsets and lengths to cause a denial of service.

The issue can be triggered when inline_data_size is configured larger than PAGE_SIZE, and page-spanning in-bounds ranges may also cause the scatterlist to be under-counted.

764) Heap-based buffer overflow (CVE-ID: CVE-2026-72130)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in nvmet_execute_auth_receive() and the DH-HMAC-CHAP response builders when processing AUTH_RECEIVE commands with a too-short allocation length. A remote user can send a specially crafted AUTH_RECEIVE command to cause a denial of service.

This is reachable only when in-band DH-HMAC-CHAP authentication is configured on the target.

765) Resource exhaustion (CVE-ID: CVE-2026-72132)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect resource accounting in NFS commit-list writeback accounting when handling unstable writes split into multiple sub-folio requests. A local user can trigger writes that are split into many small requests to cause a denial of service.

Exploitation requires NFS client write activity where a folio is split into multiple requests, such as with pNFS flexfiles striping or wsize-limited splitting.

766) Improper Initialization (CVE-ID: CVE-2026-72133)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper initialization in the spi-uniphier driver interrupt handling logic when registering an interrupt handler before initializing the associated completion. A local attacker can trigger an interrupt during driver initialization to cause a denial of service.

This may lead to complete() being called on an uninitialized completion, resulting in undefined behavior.

767) Out-of-bounds read (CVE-ID: CVE-2026-72135)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information and corrupt kernel memory.

The vulnerability exists due to an out-of-bounds read and out-of-bounds write in the TPM character device read path when processing positional read operations with a pending response. A local user can issue a crafted pread request with a large offset to disclose sensitive information and corrupt kernel memory.

The issue affects the sequential command/response TPM device interface after a command has left a response pending.

768) Improper access control (CVE-ID: CVE-2026-72136)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify an xfrm interface across network namespace boundaries.

The vulnerability exists due to improper access control in xfrmi_changelink() when handling changelink requests for xfrm interfaces. A local privileged user can send a changelink request from one network namespace to rewrite an interface that lives in another network namespace to modify an xfrm interface across network namespace boundaries.

The issue occurs because the capability check was performed only against dev_net(dev) and not against the interface link network namespace.

769) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-72138)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in gntdev_ioctl_map_grant_ref() in the xen grant device driver when handling an ioctl request and copying the operation result to userspace. A local user can trigger a copy_to_user failure after a mapping has been added to the list to cause a denial of service.

The issue can leave a mapping in priv->maps with a dangling list entry and a leaked reference count.

770) Use-after-free (CVE-ID: CVE-2026-72140)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in mlxbf_i2c_init_resource() when handling an error from devm_platform_get_and_ioremap_resource(). A local user can trigger the error path to cause a denial of service.

771) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-72142)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the i2c_imx_atomic_read function when processing SMBus block-read operations with a byte count of 0 or a count above I2C_SMBUS_BLOCK_MAX. A local user can trigger a crafted SMBus block read to cause a denial of service.

The issue can leave the i2c bus stuck with SDA held until a power cycle for the affected controller.

772) Improper resource shutdown or release (CVE-ID: CVE-2026-72144)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in dell_init() in the dell-laptop driver when handling initialization errors after resource registration. A local user can trigger an initialization failure path to cause a denial of service.

The issue occurs after rfkill setup when later LED or backlight registration fails, leaving the notifier, debugfs directory, keyboard backlight LED, or optional touchpad LED registered despite initialization failure.

773) Improper Initialization (CVE-ID: CVE-2026-72146)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper initialization in the rz-dmac DMA driver interrupt handling path when registering interrupts before channel and driver state is fully initialized. A local attacker can trigger an interrupt during device initialization to cause a denial of service.

The interrupt handler may access an uninitialized channel base pointer and uninitialized descriptor lists.

774) NULL pointer dereference (CVE-ID: CVE-2026-72147)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in dw_edma_pcie_probe() when binding a device dynamically via sysfs without driver data. A local user can bind a matching device entry without driver data to trigger a kernel crash and cause a denial of service.

775) Race condition (CVE-ID: CVE-2026-72148)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in dw_edma_v0_core_start() when concurrently starting DMA channels. A local user can trigger concurrent channel operations to cause a denial of service.

The DONE_INT_MASK and ABORT_INT_MASK registers are shared by all DMA channels, and the issue arises from a non-atomic read-modify-write sequence while updating them.

776) Improper input validation (CVE-ID: CVE-2026-72149)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the Tegra GPC DMA driver burst size calculation when processing DMA transfer requests whose lengths are not evenly divisible by the configured maximum burst size. A local user can trigger a DMA transfer with a crafted length to cause a denial of service.

This issue can cause the DMA engine to hang with a partial burst at the end, and it was observed with PL011 UART TX DMA transfers of arbitrary lengths.

777) Improper locking (CVE-ID: CVE-2026-72152)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of task state and wake-up logic in wait_for_tpm_stat() in the TPM TIS core when waiting for TPM status changes on the IRQ wait path. A local user can trigger TPM operations that exercise the affected wait path to cause a denial of service.

The issue is associated with the IRQ-based wait path and can trigger a kernel warning when CONFIG_DEBUG_ATOMIC_SLEEP is enabled.

778) Out-of-bounds read (CVE-ID: CVE-2026-72153)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in crossbar_domain_free() in the irqchip crossbar component when freeing IRQ domain mappings. A local user can trigger release of a crafted IRQ mapping state to cause a denial of service.

The issue can also leave the crossbar register connection to the source interrupt active because the wrong index is used for the irq_map entry and register update.

779) Improper locking (CVE-ID: CVE-2026-72155)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock state handling in the spi_nor_sr_unlock() function in the spi-nor software protection logic when processing unlock requests for locked blocks at the beginning of the device. A local user can request unlocking of the currently locked block or blocks to cause a denial of service.

The issue occurs when the first block, or a few first blocks, are locked and both top and bottom unlocking paths can achieve the same result.

780) Out-of-bounds read (CVE-ID: CVE-2026-72156)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in mpf_ops_parse_header() in the microchip-spi FPGA manager driver when parsing a crafted bitstream header with a zero header_size value. A local attacker can supply a crafted bitstream to trigger the out-of-bounds read and cause a denial of service.

The issue is triggered specifically when the header_size field at offset 24 is zero, causing a read one byte before the start of the buffer.

781) Out-of-bounds write (CVE-ID: CVE-2026-72157)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory.

The vulnerability exists due to an out-of-bounds write in tbnet_poll() when processing a multi-frame ThunderboltIP packet with a peer-supplied frame_count that exceeds the fragment array capacity. A remote attacker can send a specially crafted packet with 19 or more small frames to corrupt memory.

The issue occurs because the first frame is placed in the skb linear area while subsequent frames are added as page fragments.

782) Out-of-bounds read (CVE-ID: CVE-2026-72158)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in create_feature_instance() when processing crafted DFHv1 parameter headers from a malicious FPGA device. An attacker with physical access can provide a malicious FPGA device with crafted parameter headers to cause a denial of service.

The issue occurs because the computed parameter size can exceed the feature boundary and is then used in a memcpy_fromio() operation against the ioremap'd region.

783) Improper input validation (CVE-ID: CVE-2026-72159)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in ocfs2 inode validation when processing a forged dinode on an OCFS2 volume. A local user can provide a malformed inode with non-zero i_size and zero i_clusters to cause a denial of service.

Sparse regular files are exempt on volumes mounted with sparse allocation enabled, while non-inline directories are also affected by this malformed size and cluster state.

784) Improper input validation (CVE-ID: CVE-2026-72160)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in ocfs2_validate_inode_block() and ocfs2_filecheck_validate_inode_block() when processing forged OCFS2 inode metadata. A local user can provide a crafted dinode with non-canonical i_mode type bits to cause a denial of service.

The issue affects the normal read path and the online filecheck read path.

785) NULL pointer dereference (CVE-ID: CVE-2026-72161)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in ocfs2_checkpoint_inode() when evicting cached inodes during unmount. A local user can trigger inode eviction after journal shutdown to cause a denial of service.

The issue occurs because the journal may already have been freed and set to NULL during shutdown before remaining cached inodes are evicted.

786) NULL pointer dereference (CVE-ID: CVE-2026-72163)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in ocfs2_assure_trans_credits() when completing a direct write over unwritten extents after a journal abort. A local user can trigger a direct write operation and cause the kernel to panic to cause a denial of service.

Exploitation requires an ocfs2 direct I/O write path where the journal aborts during I/O completion, such as after an I/O error.

787) Improper access control (CVE-ID: CVE-2026-72164)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to overwrite file data belonging to another inode.

The vulnerability exists due to improper allocation of occupied clusters in ocfs2_move_extent() and ocfs2_probe_alloc_group() when processing a non-auto OCFS2_IOC_MOVE_EXT operation with a user-supplied physical goal. A local user can supply a crafted occupied goal value to overwrite file data belonging to another inode.

The issue occurs when the supplied goal is at the end of the target block group or when the free-run start is miscalculated.

788) Out-of-bounds read (CVE-ID: CVE-2026-72165)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds access in nand_select_target() when handling an invalid chip-select target index. A local attacker can trigger the vulnerable code path with an out-of-range cs value to cause a denial of service.

789) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-72166)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper signal handling in p9_client_rpc() in net/9p/client.c when handling P9_TFLUSH requests over an fd transport with no peer. A local user can trigger a fatal signal while a thread is blocked in the affected code path to cause a denial of service.

The issue can cause the affected task to sleep indefinitely and, in practice, can stall coredump handling in multi-threaded processes.

790) Improper resource shutdown or release (CVE-ID: CVE-2026-72167)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the pl35x NAND controller probe routine when unloading the affected kernel module after mapping device registers. A local user can trigger the affected probe and unload path to cause a denial of service.

791) Use of Uninitialized Variable (CVE-ID: CVE-2026-72168)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use of uninitialized memory in the vmu-flash driver when initializing memcard structures. A local user can trigger the vulnerable code path to cause a denial of service.

792) Race condition (CVE-ID: CVE-2026-72170)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in v9fs_dec_count in the 9p filesystem inode handling code when processing unlink operations in cacheless mode. A local user can trigger heavy unlink workloads to cause a kernel warning and system instability.

Only systems using the 9p filesystem in cacheless mode are affected.

793) Incomplete cleanup (CVE-ID: CVE-2026-72171)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper cleanup in register_device() in the slram driver when handling device registration failures. A local user can trigger allocation or registration failures to cause a denial of service.

The issue occurs after a partially initialized entry has already been linked into the global device list, and a later cleanup can dereference or free invalid state from that failed entry.

794) Improper Initialization (CVE-ID: CVE-2026-72172)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to uninitialized memory in struct pages for ZONE_DEVICE in mm/mm_init.c when hot-plugging DAX memory into an unoccupied subsection of an early section. A local attacker can hot-plug crafted DAX memory to cause a denial of service.

The issue occurs because the unoptimized boot memmap is reused for early sections while only a reduced number of struct pages are initialized, leaving remaining tail struct pages uninitialized.

795) Deadlock (CVE-ID: CVE-2026-72174)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a self-deadlock in pagemap_scan_pte_hole() when processing a PAGEMAP_SCAN ioctl with PM_SCAN_WP_MATCHING on a hugetlb VMA that reaches an unpopulated range. A local user can issue a crafted PAGEMAP_SCAN ioctl request to cause a denial of service.

The calling thread may hang in an unkillable state when the scan reaches an unpopulated part of the hugetlb range.

796) Race condition (CVE-ID: CVE-2026-72175)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in make_uffd_wp_huge_pte() in fs/proc/task_mmu.c when handling PAGEMAP_SCAN write-protection of a present HugeTLB PTE. A local user can trigger the race to cause a denial of service.

The issue can cause hardware Dirty or Accessed updates in the live PTE to be lost.

797) Use of Uninitialized Variable (CVE-ID: CVE-2026-72176)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uninitialized memory access in damon_sysfs_scheme_add_dirs() when handling an internal error during tried_regions directory setup. A local user can trigger the error path to cause a denial of service.

The issue occurs in the DAMON sysfs schemes code path when tried_regions directory setup fails from the initial allocation.

798) Use of Uninitialized Variable (CVE-ID: CVE-2026-72177)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uninitialized memory dereference in damon_sysfs_access_pattern_add_dirs() when handling error paths during sysfs directory creation. A local user can trigger allocation failures in crafted sysfs operations to cause a denial of service.

The issue occurs because directory references are released in the wrong order on error paths, and a memory leak may also result.

799) Improper resource shutdown or release (CVE-ID: CVE-2026-72179)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in populate_cache_leaves in arch/riscv/kernel/cacheinfo.c when traversing device tree cache nodes. A local user can trigger the vulnerable code path to cause a denial of service.

The issue results in a node reference leak when loop traversal ends naturally because the current node pointer becomes NULL.

800) Out-of-bounds write (CVE-ID: CVE-2026-72181)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to memory corruption in mipsmt_sys_sched_setaffinity when copying a user-supplied CPU mask from user space with CONFIG_CPUMASK_OFFSTACK enabled. A local user can supply a crafted CPU affinity mask to cause memory corruption.

Only systems with CONFIG_CPUMASK_OFFSTACK enabled are vulnerable.

801) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-72182)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a refcount leak in is_full_charged() in the charger-manager power supply driver when checking the fuel_gauge power supply state. A local user can trigger the affected code path to cause a denial of service.

802) Out-of-bounds write (CVE-ID: CVE-2026-72191)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in indx_insert_into_buffer in the ntfs3 filesystem code when processing a crafted NTFS filesystem image during file creation in a mounted directory. A local user can mount a specially crafted NTFS image and trigger filesystem operations to cause a denial of service.

Triggering the issue requires local mounting of an attacker-supplied filesystem image, such as via loopback, removable media, or USB, and a filesystem operation such as creating a file in the mounted directory.

803) Out-of-bounds write (CVE-ID: CVE-2026-72192)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to overwrite adjacent heap memory.

The vulnerability exists due to an out-of-bounds write in indx_insert_into_root in the ntfs3 index handling code when processing a crafted mounted NTFS image during file creation. A local user can create a sufficiently long file name in a directory with a full resident root to overwrite adjacent heap memory.

The overwritten bytes are copied from on-disk NTFS entries and are attacker-controlled, and exploitation depends on the surrounding slab layout.

804) Infinite loop (CVE-ID: CVE-2026-72193)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an infinite loop in check_rstbl() in the ntfs3 driver when mounting a crafted NTFS3 disk image. A local user can provide a specially crafted filesystem image to cause a denial of service.

User interaction may be required in environments that automatically mount attached removable media.

805) Stack-based buffer overflow (CVE-ID: CVE-2026-72194)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to stack-based buffer overflow in indx_find_buffer() in the ntfs3 filesystem driver when mounting a crafted NTFS filesystem and deleting a file that triggers index rebalancing. An attacker with physical access can provide a malicious NTFS image with circular index node references to cause a denial of service.

User interaction may be required in environments where removable media is mounted through desktop automount.

806) Integer underflow (CVE-ID: CVE-2026-72195)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an integer underflow leading to an out-of-bounds read in do_action() UpdateResidentValue handling in fs/ntfs3/fslog.c when processing a crafted on-disk NTFS log record during mount. A local user can supply a crafted filesystem image to trigger an oversized resident attribute data_size and disclose sensitive information.

The issue occurs when attr_off and redo_len from the on-disk log record make aoff + dlen smaller than data_off, causing data_size to wrap to nearly 4 GiB.

807) Out-of-bounds write (CVE-ID: CVE-2026-72196)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in log_replay() in the ntfs3 filesystem log replay code when mounting a malformed NTFS filesystem image. A local user can supply a crafted log record header with inconsistent lcns_follow values to cause a denial of service.

The issue is triggered on the mount path during the analysis pass.

808) Out-of-bounds write (CVE-ID: CVE-2026-72197)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in do_action() in fs/ntfs3/fslog.c when processing a crafted NTFS image during mount. An attacker with physical access can provide a specially crafted NTFS image to cause a denial of service.

The issue is triggered in the DeleteIndexEntryAllocation case when an on-disk INDEX_BUFFER entry contains a malformed size value, causing memmove() to use an invalid length. User interaction is required to mount the crafted filesystem image.

809) Out-of-bounds write (CVE-ID: CVE-2026-72212)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to memory corruption in create_altmaps_and_memory_blocks() in mm/memory_hotplug.c when handling a failure after successful memory addition with memmap_on_memory enabled. A local user can trigger this error path to cause a denial of service or execute arbitrary code.

The issue occurs because vmemmap pages allocated from an altmap may be freed into the system buddy allocator before the physical linear mapping for that memory is destroyed.

810) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72213)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in alloc_hugetlb_folio() when handling hugetlb cgroup reserved and non-reserved charges. A local user can trigger hugetlb folio allocation and later freeing to cause a denial of service.

The issue causes a page_counter underflow because the reserved charge path stores the wrong cgroup pointer in the folio and the reserved uncharge later decrements a counter that was never charged for that cgroup.

811) Improper resource shutdown or release (CVE-ID: CVE-2026-72214)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in cpcap_battery_detect_battery_type() in the cpcap-battery driver when handling battery property reads. A local user can trigger repeated battery property reads to cause a denial of service.

The issue is caused by a missing nvmem_device_put() call on the success and read-failure paths, which can create a permanent reference leak and prevent the nvmem device from being freed.

812) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72215)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect stack handling in prom_printf() when calling 32-bit firmware code from a kernel thread in 64-bit MIPS configurations. A local user can trigger console output during system bootstrap to cause a denial of service.

The issue occurs when the initial console remains in use late into bootstrap, causing the kernel to hang before startup completes.

813) Memory leak (CVE-ID: CVE-2026-72216)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in qcom_add_minidump_segments() when adding custom dump segments. A local user can trigger minidump segment handling failures to cause a denial of service.

814) Out-of-bounds write (CVE-ID: CVE-2026-72217)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in xdr_buf_to_bvec() when processing client-supplied RPC payload sizes. A remote attacker can send a specially crafted RPC request to cause memory corruption.

The out-of-bounds store can write one element past the end of the bio_vec array into adjacent slab memory, and the written length and offset fields are derived from client-controlled payload sizes.

815) Improper update of reference count (CVE-ID: CVE-2026-72218)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper reference count management in lockd nlm_lookup_file() when handling cached file lookups after nlm_do_fopen() failure. A remote user can trigger a failed file-open operation to cause a denial of service.

The issue occurs because the file reference count is incremented but not released, preventing the file from being reaped between requests.

816) Memory leak (CVE-ID: CVE-2026-72219)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in nlm_lookup_file() when processing file handles rejected by the underlying export. A remote attacker can present crafted file handles that trigger nlm_do_fopen() failures to cause a denial of service.

Each failed open attempt leaks one newly allocated nlm_file object.

817) Race condition (CVE-ID: CVE-2026-72221)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a race condition in svc_tcp_handshake() in the sunrpc server socket handling code when processing a TLS handshake callback during handshake cancellation. A remote attacker can trigger a TLS handshake timeout or interruption and cause concurrent handshake completion to corrupt the embedded swait_queue or tear down the connection to cause a denial of service.

The issue occurs when cancellation loses the race to handshake completion and the callback is still in flight.

818) Use-after-free (CVE-ID: CVE-2026-72222)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to a use-after-free in the sunrpc TLS handshake callback handling in svc_tcp_handshake() and svc_tcp_handshake_done() when a connection close overlaps an asynchronous TLS handshake. A remote attacker can trigger a connection close during the TLS handshake to cause memory corruption.

The issue is reachable on TLS-enabled NFS servers, and signal delivery during the interruptible wait can trigger the affected race window.

819) Memory leak (CVE-ID: CVE-2026-72223)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in discover_arenas() in the nvdimm btt subsystem when handling arena discovery failures. A local user can trigger an arena discovery failure to cause a denial of service.

820) Memory leak (CVE-ID: CVE-2026-72224)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to missing release of allocated memory in btt_init() in the nvdimm btt subsystem when handling BTT initialization failures. A local user can trigger an initialization failure to cause a denial of service.

821) Integer underflow (CVE-ID: CVE-2026-72225)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer underflow in jbd2_journal_initialize_fast_commit() when initializing fast commit journal metadata. A local user can trigger journal initialization with crafted journal parameters to cause a denial of service.

The issue can corrupt j_last, j_fc_first, and j_free, leading to journal abort.

822) Integer overflow (CVE-ID: CVE-2026-72226)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an out-of-bounds read.

The vulnerability exists due to an integer overflow in the batadv_tt_tvlv_unicast_handler_v1 function when processing a TT unicast TVLV containing a crafted number of VLAN entries. A remote attacker can send a specially crafted TVLV message to cause an out-of-bounds read.

823) Out-of-bounds read (CVE-ID: CVE-2026-72227)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the batman-adv multicast forwarding code when processing a crafted network header containing an undersized batadv_tvlv_mcast_tracker structure. A remote attacker can send a specially crafted packet to disclose sensitive information.

824) Improper resource shutdown or release (CVE-ID: CVE-2026-72228)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in batman-adv fragmentation handling in net/batman-adv/fragmentation.c when linearizing packets with a frag_list before splitting them. A local user can trigger a linearization failure with a crafted packet state to cause a denial of service.

825) Improper resource shutdown or release (CVE-ID: CVE-2026-72229)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to improper resource shutdown in batman-adv mesh interface cleanup when netdev registration is vetoed after creating the untagged VLAN object. A local user can trigger mesh interface registration failure to cause a memory leak.

The issue occurs because the untagged VLAN object is created during the NETDEV_REGISTER notifier path, and .dellink is not called when registration is aborted.

826) Improper resource shutdown or release (CVE-ID: CVE-2026-72230)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in batadv_frag_send_packet() in the batman-adv fragmentation component when processing packets with an empty payload or a zero fragment size. A local user can trigger the error path with such packet conditions to cause a denial of service.

827) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72231)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper state management in batadv_send_tt_request() in the batman-adv translation table component when handling translation table requests after send buffer allocation failure. A local attacker can trigger repeated translation table requests to cause a denial of service.

The issue can lead to request storms because information about a pending translation table request is lost after a failed send attempt.

828) Out-of-bounds read (CVE-ID: CVE-2026-72232)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in batadv_interface_tx() when processing a truncated packet redirected to a batadv interface through a tc filter. A local user can attach a tc filter that truncates the packet and redirects it to a batadv interface to disclose sensitive information.

Exploitation requires eBPF TC hook access.

829) Use-after-free (CVE-ID: CVE-2026-72233)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in batman-adv BLA handling when processing crafted network packets. A local attacker can send a specially crafted packet to cause a denial of service.

830) Use-after-free (CVE-ID: CVE-2026-72234)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in net/batman-adv/routing.c when processing batman-adv unicast packets. A local user can send a specially crafted packet to cause a denial of service.

831) Use-after-free (CVE-ID: CVE-2026-72235)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in batadv_interface_rx() in the batman-adv soft interface code when processing received packets after a potential skb reallocation. A remote attacker can send a specially crafted packet to cause a denial of service.

832) Observable discrepancy (CVE-ID: CVE-2026-72236)

CWE-ID: CWE-203 - Observable discrepancy

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper restriction of speculative execution in __hw_perf_event_init() in arch/s390/kernel/perf_cpum_cf.c when processing a user-controlled perf event configuration value as an array index. A local user can supply a crafted event->attr.config value to disclose sensitive information.

833) Information disclosure (CVE-ID: CVE-2026-72237)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose kernel memory addresses.

The vulnerability exists due to improper access control in the amd_brs_match_plm() branch privilege-level filtering in the AMD BRS perf event handling code when processing user-only branch stack sampling requests. A local user can invoke perf branch sampling with PERF_SAMPLE_BRANCH_USER to disclose kernel memory addresses.

The issue affects AMD processors supporting X86_FEATURE_BRS and occurs for branch records that transition from the kernel to user space.

834) Division by zero (CVE-ID: CVE-2026-72238)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to division by zero in early_serial_init() when parsing the console=uart8250 boot parameter. A local user can supply an empty, zero, invalid, or overflowing baud rate value to cause a denial of service.

The issue causes the system to hang during early boot.

835) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-72240)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a reference leak in sm501_register_device() when handling a failed device registration. A local user can trigger platform_device_register() to fail to cause a denial of service.

836) Out-of-bounds read (CVE-ID: CVE-2026-72241)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the uleds_write function when processing a user-supplied LED name string. A local user can supply a non-null-terminated string to disclose sensitive information.

837) NULL pointer dereference (CVE-ID: CVE-2026-72242)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in selinux_sctp_bind_connect() when processing SCTP ASCONF operations from the softirq path. A local user can trigger the vulnerable SCTP bind or connect handling to cause a denial of service.

The issue occurs when the hook is invoked from the ASCONF softirq path, where no file reference guarantees that sk->sk_socket is non-NULL.

838) Improper access control (CVE-ID: CVE-2026-72243)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass SELinux connect-related permission checks.

The vulnerability exists due to improper access control in the SELinux socket_sendmsg() hook when using TCP Fast Open on TCP or MPTCP stream sockets. A local user can send data with MSG_FASTOPEN to bypass SELinux connect-related permission checks.

839) Incorrect calculation (CVE-ID: CVE-2026-72244)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource allocation in the gpu buddy allocator when handling contiguous fallback allocation requests that require min_block_size alignment. A local user can trigger a misaligned allocation attempt to cause a denial of service.

840) Improper resource shutdown or release (CVE-ID: CVE-2026-72245)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in host1x_device_add() error handling for host1x_device_parse_dt() when processing device tree data. A local user can trigger a failure in device parsing to cause a denial of service.

841) Improper access control (CVE-ID: CVE-2026-72247)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass connection counting limits.

The vulnerability exists due to improper access control in nf_conncount when processing connection tuples across conntrack zones. A remote attacker can send network traffic that creates connections with matching tuples in different zones to bypass connection counting limits.

The issue affects the tuple dedup logic in __nf_conncount_add(), where original-direction tuples are compared using an incorrect zone direction value.

842) Incorrect calculation (CVE-ID: CVE-2026-72250)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of an unset header offset in nf_ct_frag6_reasm() when processing IPv6 fragments on the NF_INET_LOCAL_OUT defragmentation path. A local user can send a specially crafted fragmented IPv6 packet to cause a denial of service.

The issue occurs because skb->mac_header may still hold the unset sentinel value when no link-layer header is present yet.

843) Use-after-free (CVE-ID: CVE-2026-72251)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in nf_nat_sip in net/netfilter/nf_nat_sip.c when handling cloned socket buffers during SIP NAT processing. A local user can trigger packet processing with a cloned skb to cause a denial of service.

The issue occurs in the reply-direction destination port mangling path for SIP traffic.

844) Out-of-bounds write (CVE-ID: CVE-2026-72252)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to out-of-bounds writes in the nft_pipapo_match handling in netfilter nft_set_pipapo when processing set element insertions after a prior memory allocation failure left a cloned match in an invalid state. A local user can trigger an allocation failure and then perform a subsequent insertion in the same batch to cause memory corruption.

The issue can also affect a subsequent transaction because a bad clone may persist when the abort callback is not executed after the initial failure.

845) NULL pointer dereference (CVE-ID: CVE-2026-72253)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the nf_conntrack_sip SIP helper when processing traffic with sip_external_media enabled in subsystems where routing information is unavailable. A local user can send specially crafted network traffic to cause a denial of service.

The issue affects tc ingress and openvswitch when the sip_external_media module parameter is set to 1.

846) NULL pointer dereference (CVE-ID: CVE-2026-72254)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the nft_fib netdev egress hook handling when evaluating a fib expression in a netdev egress base chain. A local user can create a crafted nftables rule using a fib expression on the netdev egress hook to cause a denial of service.

The issue occurs because netdev hook numbers alias NF_INET_* values, allowing an egress chain to pass validation and then fault on the transmit path when nft_in(pkt) is NULL.

847) Use-after-free (CVE-ID: CVE-2026-72255)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in nf_queue handling of bridge fake dst references when processing bridged packets queued to NFQUEUE. A local user can queue bridged packets to NFQUEUE during bridge device teardown to cause a denial of service.

The issue affects systems with CONFIG_BRIDGE_NETFILTER enabled and involves queued packets carrying a fake rtable associated with a bridge device.

848) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-72256)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of template conntrack state in xt_cluster_mt() in the netfilter xt_cluster matcher when processing packets associated with a template conntrack. A local user can trigger packet processing that reaches xt_cluster_hash() with incomplete conntrack state to cause a denial of service.

The issue occurs when the raw table CT target attaches a template conntrack to skb->_nfct before normal conntrack processing.

849) NULL pointer dereference (CVE-ID: CVE-2026-72257)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in graph_callback in the q6apm ASoC component when handling late DSP buffer-done responses after buffers have been freed. A local user can trigger the race condition to cause a denial of service.

This issue is exposed by a race between buffer cleanup and asynchronous DSP response handling.

850) Improper resource shutdown or release (CVE-ID: CVE-2026-72258)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the MT8183 AFE probe in sound/soc/mediatek/mt8183/mt8183-afe-pcm.c when handling device probe failures or driver removal. A local user can trigger device initialization and cleanup conditions to cause a denial of service.

The issue arises when reserved memory is assigned through of_reserved_mem_device_init() and the assignment is not released consistently on cleanup.

851) Improper resource shutdown or release (CVE-ID: CVE-2026-72259)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the MT8192 AFE probe path when handling reserved memory assignment during device probe and driver cleanup. A local user can trigger device probe failure or driver unbind to cause a denial of service.

The issue occurs when reserved memory is successfully assigned and is not released during cleanup.

852) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-72260)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in mt8192_afe_pcm_dev_probe() when probing the MT8192 AFE device and reinitializing the regmap cache during runtime power management resume. A local user can trigger device probe under conditions where runtime resume fails to cause a denial of service.

The issue can leave the power management usage count incremented and continue probe while the device may not be accessible.

853) Out-of-bounds write (CVE-ID: CVE-2026-72261)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds write in snd_sof_update_control when processing firmware-provided control data. A local user can provide inconsistent control data values to cause a denial of service.

The issue occurs because num_elems was validated against a stored size field but not against the actual ipc_control_data allocation size before memcpy.

854) Heap-based buffer overflow (CVE-ID: CVE-2026-72262)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or disclose sensitive information.

The vulnerability exists due to a heap-based buffer overflow and out-of-bounds read in the SOF IPC3 bytes control handling in sound/soc/sof/ipc3-control.c when processing data through the ALSA TLV kcontrol interface. A local user can send specially crafted control data to cause a denial of service or disclose sensitive information.

The issue affects the bytes_ext put and get paths, including an error-path restore operation that can write past the end of the allocated buffer.

855) Memory leak (CVE-ID: CVE-2026-72264)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in trident_pci_probe() when handling a PCI device probe error path. A local user can trigger the vulnerable code path to cause a denial of service.

856) Memory leak (CVE-ID: CVE-2026-72265)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in nvidiafb_probe() when handling device initialization errors. A local user can trigger an error path during device probing to cause a denial of service.

857) Memory leak (CVE-ID: CVE-2026-72266)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in vesafb_probe() in the vesafb driver when probing the device and processing framebuffer options. A local user can trigger the vulnerable code path to cause a denial of service.

858) Memory leak (CVE-ID: CVE-2026-72267)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in alloc_carmine_fb() when handling an error path after converting video modes to a modelist. A local user can trigger the vulnerable code path to cause a denial of service.

859) Memory leak (CVE-ID: CVE-2026-72268)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in tdfxfb_probe() in the tdfxfb driver when handling device initialization error paths. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs when CONFIG_FB_3DFX_I2C is defined.

860) Improper resource shutdown or release (CVE-ID: CVE-2026-72269)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in uvesafb_probe() when handling error paths during device initialization. A local user can trigger an error condition to cause a denial of service.

861) Memory leak (CVE-ID: CVE-2026-72270)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in s3_pci_probe() when probing a PCI device. A local user can trigger the driver initialization error path to cause a denial of service.

862) Memory leak (CVE-ID: CVE-2026-72271)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in i740fb_probe() when handling device initialization error paths. A local user can trigger the vulnerable error conditions to cause a denial of service.

863) Memory leak (CVE-ID: CVE-2026-72272)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in radeonfb_pci_register() when handling error paths after allocating display mode list entries. A local user can trigger the affected code path to cause a denial of service.

864) Memory leak (CVE-ID: CVE-2026-72273)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in efifb_probe() in the efifb framebuffer driver when processing option strings returned by fb_get_options(). A local user can trigger the vulnerable code path to cause a denial of service.

865) Improper resource shutdown or release (CVE-ID: CVE-2026-72274)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in hecubafb_probe() when handling device initialization errors. A local user can trigger an error path during initialization to cause a denial of service.

866) Memory leak (CVE-ID: CVE-2026-72275)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in broadsheetfb_probe() when handling device initialization errors. A local user can trigger the vulnerable error path to cause a denial of service.

The issue occurs because memory allocated for pagerefs in deferred I/O initialization is not released on an error path.

867) Improper resource shutdown or release (CVE-ID: CVE-2026-72276)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in metronomefb_probe() when handling an error path after deferred I/O initialization. A local user can trigger device initialization failure to cause a denial of service.

868) Use-after-free (CVE-ID: CVE-2026-72282)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in kvm_io_bus_get_dev() and vgic_msi_to_its() when processing KVM MMIO bus device lookups for MSI addresses. A local user can trigger access to a matched device after the srcu lock has been dropped to cause a denial of service.

The issue occurs when the returned device matches only by address and is not the expected device type.

869) Improper Initialization (CVE-ID: CVE-2026-72284)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the KVM x86 LAPIC PV EOI handling logic when processing PV EOI state synchronization for a vCPU after PV EOIs have been disabled. A local user can trigger this condition to cause a denial of service.

The issue results in a kernel BUG and invalid opcode exception in the KVM subsystem.

870) Race condition (CVE-ID: CVE-2026-72289)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in vgic_prune_ap_list() in the KVM arm64 virtual generic interrupt controller when migrating an interrupt to another vCPU while locks are temporarily dropped. A local user can trigger interrupt migration during this race to cause a denial of service.

The issue can result in list_del() being performed on an interrupt entry that has already been removed from the ap_list.

871) Improper resource shutdown or release (CVE-ID: CVE-2026-72290)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in kvm_s390_pci_aif_enable() when handling AIF enablement errors. A local user can trigger a failure during AIF enablement to cause a denial of service.

The issue affects the s390 KVM PCI interrupt setup error path.

872) Improper input validation (CVE-ID: CVE-2026-72296)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in ife_decode() when processing malformed IFE frames. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue can crash the kernel when the inner Ethernet header is not sufficiently accessible from the linear data area before the packet is passed to eth_type_trans().

873) Out-of-bounds read (CVE-ID: CVE-2026-72297)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in pvc_info() when reading /proc/net/atm/pvc after storing a crafted QoS traffic_class value. A local user can supply out-of-range QoS parameters to trigger an out-of-bounds read and disclose sensitive information.

The issue is caused by invalid traffic_class values being accepted into vcc->qos during QoS validation.

874) Integer overflow (CVE-ID: CVE-2026-72298)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer overflow leading to out-of-bounds write in qrtr_endpoint_post() when processing a crafted incoming qrtr packet. A remote attacker can send a specially crafted packet to cause a denial of service.

Only 32-bit systems are affected; 64-bit systems are unaffected.

875) Use-after-free (CVE-ID: CVE-2026-72299)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in TIPC enqueue tracepoint queue dumping in tipc_sk_enqueue() when dumping socket queues during message enqueue processing. A local user can trigger crafted TIPC socket activity to cause a denial of service.

The issue is reachable while the socket is owned by user context, because the held spinlock protects the backlog queue but does not serialize access to sk_receive_queue.

876) Out-of-bounds read (CVE-ID: CVE-2026-72300)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in sof_parse_token_sets in the SOF topology parser when parsing malformed topology private data. A local user can provide a specially crafted topology blob with a truncated trailing vendor array to cause a denial of service.

877) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-72301)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a time-of-check time-of-use flaw in sof_ipc3_bytes_put() when copying user-supplied control data. A local user can provide crafted control data with a different size than the previously stored buffer contents to cause a denial of service.

The copied length is derived from the old buffered size rather than the incoming size field.

878) Out-of-bounds read (CVE-ID: CVE-2026-72301)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in sof_ipc3_bytes_get() when handling crafted control data. A local user can provide crafted control data with an invalid size value to disclose sensitive information.

879) Integer overflow (CVE-ID: CVE-2026-72302)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds access.

The vulnerability exists due to integer overflow in sof_ipc3_control_update() in sound/soc/sof/ipc3-control.c when processing firmware-provided control data. A local user can provide a crafted num_elems value to trigger size miscalculation and cause an out-of-bounds access.

The issue occurs on 32-bit platforms where the size calculation can wrap to a smaller value, allowing a mismatched size check to pass before snd_sof_update_control is reached.

880) Improper input validation (CVE-ID: CVE-2026-72304)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in sof_ipc4_bytes_put when processing user-supplied control data. A local user can provide crafted control data with a mismatched size field to cause a denial of service.

The copy length is derived from the previously stored buffer header rather than the incoming header, which can result in truncated data or stale bytes being copied.

881) Improper Initialization (CVE-ID: CVE-2026-72305)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper initialization in VDUSE bounce page allocation when mapping bounce pages to userspace. A local user can trigger bounce page mappings to disclose sensitive information.

882) Race condition (CVE-ID: CVE-2026-72306)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in vduse_dev_msg_sync and vduse_dev_read_iter in drivers/vdpa/vdpa_user/vduse_dev.c when handling VDUSE device message processing. A local user can trigger concurrent message operations to cause a denial of service.

The issue can lead to a double list_del() crash when a timed-out message is concurrently removed.

883) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-72307)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect reference count management in mlxsw_sp_vrs_lpm_tree_replace() when rolling back failed LPM tree replacements for virtual routers. A local user can trigger an error during LPM tree replacement to cause a denial of service.

884) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-72308)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a reference count leak in mlxsw_sp_port_lag_join() when handling an error from mlxsw_sp_port_lag_index_get(). A local user can trigger the error path to cause a denial of service.

885) Integer overflow (CVE-ID: CVE-2026-72310)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an integer overflow in smb2_ioctl_query_info() when validating a PASSTHRU_FSCTL response payload from a malicious server. A remote attacker can send a specially crafted server response to disclose sensitive information.

The out-of-bounds read occurs during a later copy_to_user() operation after a wrapped offset-plus-length check passes.

886) Improper access control (CVE-ID: CVE-2026-72312)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disable the PF promiscuous and all-multicast receive rules.

The vulnerability exists due to improper access control in the nix_set_rx_mode mailbox handler when processing a VF interface request with promiscuous and all_multi flags set to false. A local user can bring up or tear down a VF interface to disable the PF promiscuous and all-multicast receive rules.

The issue occurs because the rule enable and disable APIs operate on the PF even when the mailbox request is issued through a VF interface.

887) Improper handling of exceptional conditions (CVE-ID: CVE-2026-72314)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in regulator_lock_two() when handling lock contention between two regulators. A local user can trigger lock contention to cause a denial of service.

This issue is exploitable in practice on MIPS systems.

888) Race condition (CVE-ID: CVE-2026-72315)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in the cifs client direct i/o request cleanup and unmount handling when processing direct i/o writes during unmount. A local user can trigger direct i/o activity and unmount a cifs mount to cause a denial of service.

The issue results in a busy dentry warning because dentry reference counts may remain in use until delayed cleanup work completes.

889) NULL pointer dereference (CVE-ID: CVE-2026-72316)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in metadata_open() when handling an allocation failure. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs because a NULL return value was treated as a valid metadata pointer instead of an error.

890) Use-after-free (CVE-ID: CVE-2026-72317)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the SUNRPC TLS connect_worker when handling a failed TLS handshake on a TLS-secured transport. A local user can trigger a failed TLS handshake that causes the upper rpc_clnt to be freed before the queued worker dereferences it to cause a denial of service.

The issue affects the TLS transport path; the non-TLS connect worker does not use the saved client pointer.

891) Out-of-bounds read (CVE-ID: CVE-2026-72318)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in parse_dfs_referrals() when processing a malicious DFS referral response from a server. A remote attacker can supply crafted referral string offsets to cause an out-of-bounds read and disclose sensitive information.

The issue occurs when DfsPathOffset or NetworkAddressOffset points beyond the end of the response buffer, leading to a negative length being forwarded as a size_t in the non-Unicode path.

892) Improper input validation (CVE-ID: CVE-2026-72319)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in ip_vs_in_icmp in the IPVS subsystem when processing ICMP error packets from tunnels. A remote attacker can send a specially crafted ICMP error packet to cause a denial of service.

The issue involves inner IP headers not being ensured in skb headroom after outer headers are stripped, and additional length checks were required for the inner headers.

893) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-72320)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass netfilter rules.

The vulnerability exists due to improper handling of inverted lookups in nft_lookup_eval() when processing catchall elements for interval sets. A local user can trigger a crafted lookup condition to bypass netfilter rules.

The issue affects inverted lookups using catchall elements for the open-ended default range in interval sets.

894) Use-after-free (CVE-ID: CVE-2026-72322)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in the IPv6 MLD delayed work handling in net/ipv6/mcast.c when processing incoming MLD queries during device teardown. A remote attacker can send crafted MLD query traffic to trigger a kernel panic and cause a denial of service.

The issue arises from a race condition between device destruction and packet receive processing under RCU protection.

895) Use-after-free (CVE-ID: CVE-2026-72323)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the IGMP timer callback when processing incoming IGMP queries during device teardown. A remote attacker can send a crafted IGMP query to cause a denial of service.

Exploitation requires a race between device destruction and IGMP query processing.

896) Improper resource shutdown or release (CVE-ID: CVE-2026-72324)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the mvebu GPIO IRQ domain removal handler when unbinding the device. A local user can trigger device unbinding to cause a denial of service.

897) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72325)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper hardware feature state management in the amd perf events handling in arch/x86/events/amd/core.c when reloading virtualization state on PerfMonV2-capable processors. A local user can toggle SVM on a CPU with active LBR events to cause a denial of service.

The issue occurs on processors that have LBR but not BRS, where writing the deprecated BRS enable bit triggers a #GP fault.

898) Integer underflow (CVE-ID: CVE-2026-72326)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect rate accounting.

The vulnerability exists due to an integer underflow in the CAKE packet length calculation in net/sched/sch_cake.c when processing packets with a negative overhead adjustment. A local user can configure a crafted overhead value to cause incorrect rate accounting.

Exploitation requires the ability to configure CAKE scheduler parameters.

899) NULL pointer dereference (CVE-ID: CVE-2026-72327)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in v3d_get_cpu_indirect_csd_params() when processing a userspace-supplied indirect BO handle during indirect CSD setup. A local user can submit a bogus or stale handle to cause a denial of service.

900) Improper handling of exceptional conditions (CVE-ID: CVE-2026-72330)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of zero-length TLS application_data records in tls_sw_read_sock() when processing a specially crafted TLS record. A remote attacker can send a zero-length TLS application_data record to cause a denial of service.

Only the read_sock() path is affected.

901) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-72334)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of malformed packet sequences in the Bluetooth ISO packet reassembly logic in net/bluetooth/iso.c when processing malformed ISO_START, ISO_CONT, and ISO_END frames from a Bluetooth controller. A remote attacker can send a specially crafted sequence of malformed Bluetooth ISO frames to cause a denial of service.

The issue can lead to a kernel panic when an oversized ISO_END frame is processed, and malformed fragment sequences can also leave an unfinished receive buffer allocated.

902) Use-after-free (CVE-ID: CVE-2026-72335)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in mgmt_add_adv_patterns_monitor_complete in the Bluetooth management subsystem when handling advertisement monitor add completion after a failed MSFT offload add operation. A local user can send a crafted Bluetooth management request to trigger the use of freed memory and cause a denial of service.

The issue occurs in the queued management add flow after a monitor is inserted before the powered MSFT setup step, and it was reproduced by KASAN as a slab-use-after-free.

903) Use-after-free (CVE-ID: CVE-2026-72336)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in lowpan_control_write in the Bluetooth 6LoWPAN subsystem when handling a debugfs control write that races with L2CAP connection teardown. A local user can trigger concurrent connection and disconnect or device close activity to cause a denial of service.

The issue arises because an L2CAP connection reference is not held after device protection is released, allowing the connection to be freed before later dereference.

904) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-72338)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to perform an out-of-bounds heap write.

The vulnerability exists due to a time-of-check time-of-use race condition leading to an out-of-bounds write in the act_pedit tc offload handling when sizing and filling a flow_rule buffer during cls_flower offload processing. A local privileged user can trigger concurrent action and classifier operations to perform an out-of-bounds heap write.

The written data is attacker-controlled and can corrupt an adjacent slab object.

905) Off-by-one (CVE-ID: CVE-2026-72339)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an off-by-one error in the qede_rx_build_skb() and qede_tpa_rx_build_skb() functions when handling a NULL return from qede_build_skb() under memory pressure. A local user can trigger memory pressure and network receive processing to cause memory corruption.

The issue can desynchronize the BD ring, which can corrupt DMA page reference counts and lead to SLUB freelist corruption.

906) Race condition (CVE-ID: CVE-2026-72340)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt hardware rule entries.

The vulnerability exists due to a race condition in the microchip vcap api and debugfs rule dump handling when accessing shared Super VCAP instances concurrently. A local user can trigger concurrent rule dump and rule write operations to corrupt hardware rule entries.

The issue affects sparx5 and lan969x devices where IS0 and IS2 instances share the same Super VCAP hardware block, cache, and command registers.

907) Race condition (CVE-ID: CVE-2026-72342)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the mlx5 hv vhca stats agent registration and workqueue handling when processing asynchronous control invalidation callbacks during agent creation. A local user can trigger the vulnerable control path to cause a denial of service.

The issue can lead to a NULL function pointer invocation, timer list corruption, or a NULL pointer dereference.

908) Out-of-bounds write (CVE-ID: CVE-2026-72343)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in mlx5e_hv_vhca_stats_work() and mlx5e_hv_vhca_stats_create() when handling hypervisor VHCA statistics after channel initialization. A local user can trigger stats handling with an incorrectly sized buffer to cause a denial of service.

The issue can result from a zero-sized allocation that leaves the buffer pointer set to ZERO_SIZE_PTR, and may also occur across a detach and resume cycle when buffer sizing becomes smaller than the persisted channel count.

909) Improper input validation (CVE-ID: CVE-2026-72347)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the xt_connmark CONNMARK target revision 2 handling when evaluating a rule with invalid shift parameters. A local user can install a malformed rule with a shift_bits value of 32 or more or an invalid shift_dir value to cause a denial of service.

The issue is triggered when the malformed rule is evaluated in the packet path.

910) Improper input validation (CVE-ID: CVE-2026-72348)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass packet-filtering rules.

The vulnerability exists due to improper input validation in the ip6tables ah, hbh, and rt IPv6 extension header match handlers when processing malformed IPv6 packets with advertised extension header lengths that exceed the available skb data. A remote attacker can send a specially crafted IPv6 packet to bypass packet-filtering rules.

The issue affects handling of malformed IPv6 authentication, hop-by-hop, and routing extension headers.

911) Integer overflow (CVE-ID: CVE-2026-72349)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass intended rate-based matching logic.

The vulnerability exists due to integer truncation in xt_rateest_mt() in netfilter xt_rateest when processing rate estimator values on high-speed links. A local user can trigger rate comparisons involving byte rates above 2^32-1 to bypass intended rate-based matching logic.

The issue occurs on links faster than approximately 34 Gbps, where the byte rate may exceed 4.3 GBps and no longer fits in 32-bit variables.

912) Incorrect Bitwise Shift of Integer (CVE-ID: CVE-2026-72350)

CWE-ID: CWE-1335 - Incorrect Bitwise Shift of Integer

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds shift operation in u32_match_it() in the xt_u32 netfilter match when evaluating a malformed u32 rule during packet processing. A local user can supply a crafted u32 rule with a shift count of 32 or more to cause a denial of service.

913) Out-of-bounds read (CVE-ID: CVE-2026-72351)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in gue_remcsum() and gue_gro_remcsum() when processing malformed GUE packets with the REMCSUM private flag set but without the required REMCSUM metadata fields. A remote attacker can send a specially crafted packet to disclose sensitive information.

The issue occurs because option validation accepts packets that contain only the private flags field even when additional REMCSUM start and offset fields are expected.

914) Integer overflow (CVE-ID: CVE-2026-72352)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in hid_bpf_get_data() in the HID-BPF subsystem when validating a caller-provided offset and size. A local user can supply a crafted offset and size combination to cause a denial of service.

Exploitation requires the ability to invoke the HID-BPF helper.

915) Double free (CVE-ID: CVE-2026-72361)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in hw_engine_init() in the drm/xe hw_engine component when handling a probe failure error path for a managed BO allocated with xe_managed_bo_create_pin_map(). A local user can trigger the affected initialization error path to cause a denial of service.

The issue occurs because the managed BO already has a devm cleanup action registered, and a second cleanup happens during device-managed resource unwinding.

916) NULL pointer dereference (CVE-ID: CVE-2026-72362)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in xe_pt_zap_ptes_entry() when processing unpopulated page-table entries during a page-table walk. A local user can trigger the driver to handle an entry with a NULL child pointer to cause a denial of service.

917) Integer overflow (CVE-ID: CVE-2026-72369)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to an integer overflow in minix_blocks_needed() in the Minix filesystem superblock handling when mounting a crafted Minix v3 filesystem image. An attacker with physical access can provide a crafted filesystem image with inode or zone counts near UINT_MAX to trigger a kernel panic.

The issue occurs because a zero bitmap block count can be accepted as valid, leading minix_fill_super() to dereference s_imap[0] or s_zmap[0] without allocated bitmap buffers.

918) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72371)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in afs_insert_volume_into_cell() when replacing an AFS volume entry in the cell volume tree. A local user can trigger volume replacement operations to cause a denial of service.

The issue can cause the old volume to be removed from the tree twice while the new volume is never removed.

919) NULL pointer dereference (CVE-ID: CVE-2026-72373)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a missing null pointer check in afs_break_some_callbacks() when handling callback breaks for an unknown AFS volume. A local user can trigger callback processing referencing an unknown volume to cause a denial of service.

920) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-72374)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of incomplete message parsing state in afs callback service message parsers when processing callback notification request streams. A remote attacker can send crafted callback messages with incomplete packet sequences to cause a denial of service.

The issue affects the AFS filesystem client callback service that listens through an rxrpc server for callback notifications.

921) Improper Initialization (CVE-ID: CVE-2026-72376)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in afs_alloc_cell in fs/afs/cell.c when allocating AFS cells. A local user can trigger an idr_alloc_cyclic() failure to cause a denial of service.

922) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-72378)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in afs_extract_vl_addrs() when parsing AFS volume location address data. A local user can trigger processing of malformed address data to cause a denial of service.

923) Improper access control (CVE-ID: CVE-2026-72379)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to create a temporary file with invalid ownership.

The vulnerability exists due to improper access control in vfs_tmpfile() when creating an O_TMPFILE on an idmapped mount that does not map the caller's fsuid or fsgid. A local user can create a temporary file on such a mount to create a temporary file with invalid ownership.

The issue affects filesystems that support idmapped mounts and implement tmpfile handling, as well as overlayfs through upper-layer tmpfile creation.

924) Integer underflow (CVE-ID: CVE-2026-72382)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer underflow in parse_dacl() in fs/smb/server/smbacl.c when processing a crafted security descriptor in SMB2_SET_INFO security information requests. A remote attacker can send a specially crafted request to cause a denial of service.

The issue can bypass the ACE count guard for undersized DACLs and trigger large temporary ACL state and pointer-array allocations.

925) Use-after-free (CVE-ID: CVE-2026-72384)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ts4800 irqchip chained interrupt handler when the parent interrupt fires after the driver has been removed. A local user can trigger the parent interrupt after driver removal to cause a denial of service.

The issue stems from the chained handler not being cleared during device removal, leaving a dangling handler reference.

926) Use-after-free (CVE-ID: CVE-2026-72389)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the STP timer handling in the Linux kernel bridge subsystem when deleting a bridge while the topology change timer is armed on an administratively down bridge. A local user can trigger bridge topology change detection and delete the bridge to cause a denial of service.

The issue occurs because the IFF_UP check was missing in br_topology_change_detection().

927) Use-after-free (CVE-ID: CVE-2026-72390)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the sch_teql qdisc implementation when processing concurrent modifications to the teql master slaves list during packet transmission and qdisc teardown. A local user can trigger concurrent qdisc operations to cause a denial of service.

The issue arises from a race condition across CPUs involving stale pointers retained during list traversal.

928) Memory leak (CVE-ID: CVE-2026-72391)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in sfp_i2c_mdiobus_destroy() when removing a copper or RollBall SFP module that instantiated an MDIO bus. A local user can trigger module hot-removal to cause a denial of service.

The issue is triggered on module hot-removal and not on driver unbind.

929) NULL pointer dereference (CVE-ID: CVE-2026-72392)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in fib6_walk_continue() when resuming a multi-batch IPv6 FIB dump after a concurrent table insertion changes hash-chain ordering. A remote attacker can trigger netlink dump processing to cause a denial of service.

The issue occurs because walker state can become inconsistent, with the root referencing a different table while the node still points into the previous one.

930) Improper handling of exceptional conditions (CVE-ID: CVE-2026-72395)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to bypass hardware protection handling.

The vulnerability exists due to improper exception handling in the pmbus regulator event notification worker when processing combined regulator fault events. A local privileged user can trigger multiple distinct regulator events before the worker runs to bypass hardware protection handling.

The issue occurs because combined event bitmasks are passed unmodified to the regulator core, where strict event handling can leave the fault reason unset.

931) Out-of-bounds read (CVE-ID: CVE-2026-72396)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in adm1275_probe() when comparing a device-provided model string returned by i2c_smbus_read_block_data(). A local user can provide a shortened crafted device string to cause the kernel to read uninitialized stack memory and disclose sensitive information.

Exploitation requires access to a device handled by the adm1275 hwmon driver.

932) Out-of-bounds write (CVE-ID: CVE-2026-72399)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in enetc_xdp_xmit when processing xdp_frame structures with too many fragments. A local user can provide a crafted xdp_frame with more fragments than ENETC_MAX_SKB_FRAGS to cause a denial of service.

The issue occurs because the xdp_redirect_arr array is sized to ENETC_MAX_SKB_FRAGS while an xdp_frame may contain a greater number of fragments.

933) Out-of-bounds read (CVE-ID: CVE-2026-72400)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in seg6_validate_srh() when processing a BPF program-supplied Segment Routing Header length in the SEG6 encapsulation path. A local user can supply a crafted short SEG6 encapsulation header to disclose sensitive information.

Exploitation is reachable through the BPF SEG6 encap path, including the SEG6 local BPF END_B6 and END_B6_ENCAP actions.

934) Information disclosure (CVE-ID: CVE-2026-72402)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in the BPF verifier log output in print_bpf_insn() when printing ldimm64 instructions with pointer-bearing pseudo sources. A local user can trigger verifier logging of crafted BPF instructions to disclose sensitive information.

The issue occurs when pointer leaks are not allowed but certain pseudo source types are still resolved to kernel pointer values before the verifier log prints the instruction.

935) Use-after-free (CVE-ID: CVE-2026-72405)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in udp_tunnel_nic_device_sync_work() when handling concurrent device operations. A local user can trigger concurrent device operations to cause a denial of service.

The issue arises because a second work item can remain queued while the associated structure is freed.

936) Double free (CVE-ID: CVE-2026-72406)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in gem_init_one() in the sungem network driver when handling a failed register_netdev() call during device probe. A local user can trigger the vulnerable error path to cause a denial of service.

The issue occurs in the probe error cleanup path for a half-registered device.

937) Improper locking (CVE-ID: CVE-2026-72409)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the mvneta resume path when resuming the system while NAPI poll is pending after a per-CPU interrupt has been disabled. A local user can trigger a suspend and resume sequence during this condition to cause a denial of service.

This affects Marvell MPIC platforms using the mvneta driver, where the per-CPU interrupt can remain masked after resume and result in complete loss of network connectivity.

938) Improper input validation (CVE-ID: CVE-2026-72410)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify NIX maximum logical function settings in an invalid state.

The vulnerability exists due to improper input validation in the devlink NIX maximum LF validation logic in rvu_devlink.c when handling devlink commands before or during NIX LF assignment. A local privileged user can issue a devlink command to modify NIX maximum LF settings in an invalid state.

The issue affects the octeontx2-af driver logic that is intended to permit resizing only before any LF attach requests from PFs and VFs and not later or concurrently.

939) Memory leak (CVE-ID: CVE-2026-72413)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in SCTP INIT handling in net/sctp/sm_statefuns.c when processing INIT chunks with unrecognized parameters. A remote attacker can send a specially crafted INIT chunk to cause a denial of service.

The issue occurs when err_chunk is allocated by sctp_verify_init() and is not freed on certain error and success return paths.

940) Division by zero (CVE-ID: CVE-2026-72414)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to division by zero in future_base_time() in the sja1105 PTP perout handling code when processing a user-provided period value that becomes zero after conversion to SJA1105 clock ticks. A local user can provide a very small period value to trigger a kernel crash and cause a denial of service.

941) Improper input validation (CVE-ID: CVE-2026-72416)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in nft_compat ebtables target validation when handling bridge table targets. A local user can use a non-bridge target in the ebtables emulation path to cause a denial of service.

942) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-72418)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state handling in nf_conncount when processing early-confirmed connection tracking entries for reused TIME_WAIT sockets or similar setup packets. A remote attacker can initiate network connections that trigger miscounting to cause a denial of service.

The issue can cause valid new connections to be falsely rejected in connlimit soft-limiting scenarios.

943) Out-of-bounds read (CVE-ID: CVE-2026-72419)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in nf_nat_register_fn in the netfilter nf_nat subsystem when handling netfilter netlink requests after nf_nat_init() has failed. A local privileged user can send a specially crafted netfilter request to cause a denial of service.

The issue can occur when nf_nat_core is built in and initialization has failed, leaving an invalid nat_net pointer state for dependent modules.

944) Race condition (CVE-ID: CVE-2026-72420)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a data race in break_stripe_batch_list() and raid5_make_request() in the md/raid5 subsystem when handling overlapping stripe I/O requests. A local user can submit crafted I/O that triggers the R5_Overlap flag race to cause a denial of service.

The issue can leave a task waiting on a bit indefinitely.

945) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-72421)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass intended unreachable routing behavior.

The vulnerability exists due to improper control flow in fib_lookup() in the IPv4 FIB lookup logic when performing route lookups with CONFIG_IP_MULTIPLE_TABLES enabled and no rule added. A local user can configure routes that trigger lookup of the merged local/main table followed by the default table to bypass intended unreachable routing behavior.

The issue occurs because an error route result from the local or main table can be overwritten by a subsequent lookup in the default table.

946) Use-after-free (CVE-ID: CVE-2026-72422)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in smb3_preauth_hash_rsp() when processing concurrent SMB2 NEGOTIATE requests on the same connection. A remote attacker can send concurrent SMB2 NEGOTIATE requests that trigger a race and dereference freed memory to cause a denial of service.

The issue is a race between the SMB2 NEGOTIATE handler and the response send path, where a NULL check can be bypassed by concurrent freeing of conn->preauth_info before dereference.

947) NULL pointer dereference (CVE-ID: CVE-2026-72424)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the msc313 RTC shared IRQ handler when handling a shared IRQ during device probe before driver data is initialized. A local attacker can trigger the shared interrupt in that window to cause a denial of service.

The issue occurs in interrupt context on systems where the IRQ line is shared with another device.

948) Improper resource shutdown or release (CVE-ID: CVE-2026-72425)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in ice_reset_all_vfs() when resetting virtual functions with FDIR filters enabled. A local user can trigger a VF reset after enabling an FDIR filter to cause a denial of service.

The issue occurs because CTRL VSI objects are invalidated but not freed for affected virtual functions.

949) Use-after-free (CVE-ID: CVE-2026-72427)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the cgroup BPF effective program array handling in kernel/bpf/cgroup.c when updating or detaching BPF programs with BPF_F_PREORDER configurations. A local user can trigger incorrect effective array slot selection to cause a denial of service.

The issue occurs because preorder programs are placed at the front of the effective array, so linear traversal of the program list can select the wrong slot.

950) Incorrect calculation (CVE-ID: CVE-2026-72428)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass Spectre v4 sanitization checks.

The vulnerability exists due to improper index calculation in check_stack_write_fixed_off() in the BPF verifier when handling fixed-offset stack writes. A local user can trigger a crafted stack write pattern to bypass Spectre v4 sanitization checks.

The issue occurs because the sanitization pre-check examines different stack slot bytes than the write path updates.

951) Improper resource shutdown or release (CVE-ID: CVE-2026-72430)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a resource leak.

The vulnerability exists due to improper resource shutdown or release in tcf_ct_fill_params() in net/sched/act_ct.c when handling failed RTM_NEWACTION requests with TCA_CT_LABELS present on certain error paths. A local user can send a crafted RTM_NEWACTION request to cause a resource leak.

Exploitation requires CAP_NET_ADMIN over a network namespace and is reachable from an unprivileged user namespace on default-userns kernels.

952) Use of Uninitialized Variable (CVE-ID: CVE-2026-72433)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to uninitialized memory exposure in nft_meta_bridge_get_eval in nft_meta_bridge.c when evaluating the NFT_META_BRI_IIFPVID metadata expression. A local attacker can trigger processing of a bridge interface PVID query that encounters an error condition to disclose sensitive information.

953) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72434)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper shutdown of delayed work in the ipset garbage collector in netfilter when destroying a set with timeouts enabled. A local user can destroy a crafted set to cause a denial of service.

Only sets configured with timeout support are affected.

954) Use-after-free (CVE-ID: CVE-2026-72435)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ipset comment extension handling in netfilter when freeing comment extension pointers. A local user can trigger ipset comment initialization or cleanup operations to cause a denial of service.

955) Race condition (CVE-ID: CVE-2026-72436)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in netfilter ipset hash types when lockless RCU readers process set data in parallel with add, delete, or garbage-collection operations. A local user can trigger concurrent ipset operations to cause a denial of service.

The issue affects readers that are not protected by the region lock and are not in set destroy or new or temporary set creation phases.

956) Memory leak (CVE-ID: CVE-2026-72437)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in raid1_read_request() in the md/raid1 subsystem when handling retried reads with REQ_NOWAIT set and the read would block on retry. A local user can trigger this condition to cause a denial of service.

The issue occurs when a pre-allocated r1_bio already exists for the retried read and wait_read_barrier() fails.

957) Improper resource shutdown or release (CVE-ID: CVE-2026-72438)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in raid10_handle_discard() in drivers/md/raid10.c when handling discard requests and discard split allocation failures. A local user can trigger discard failure paths to cause a denial of service.

The issue is caused by missing releases of writes_pending and barrier references on certain error paths.

958) Use of uninitialized resource (CVE-ID: CVE-2026-72441)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to uninitialized memory usage in dgram_recvmsg() when copying a socket address to user space after parsing an IEEE 802.15.4 address with mode IEEE802154_ADDR_NONE. A local user can receive a crafted packet and invoke recvmsg() to disclose sensitive information.

The issue occurs because the pan_id field of struct ieee802154_addr is left uninitialized when the address mode is IEEE802154_ADDR_NONE.

959) Use-after-free (CVE-ID: CVE-2026-72443)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ALSA usb-audio MIDI 2.0 endpoint handling code when freeing endpoints after a later setup failure while submitted input URBs can still complete. A local user can trigger the vulnerable create-error path to cause a denial of service.

The issue occurs because a completion handler may dereference freed endpoint state or attempt to resubmit from a stale endpoint after URBs were started.

960) Out-of-bounds read (CVE-ID: CVE-2026-72444)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized memory contents.

The vulnerability exists due to an out-of-bounds read in __skb_flow_dissect() when processing packets on non-ethernet devices with flow dissector ethernet address matching enabled. A local user can send a crafted packet through AF_PACKET to disclose uninitialized memory contents.

Exploitation requires a TUN device in L3 mode together with a multiq qdisc and a flower filter matching on eth_src.

961) Race condition (CVE-ID: CVE-2026-72447)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized kernel memory to userspace.

The vulnerability exists due to a race condition in sctp_diag endpoint dumping when traversing endpoint address lists during diagnostic dumping without holding the socket lock. A local user can trigger concurrent socket operations while requesting SCTP diagnostic endpoint data to disclose uninitialized kernel memory to userspace.

The issue occurs because address counts gathered under RCU protection can become inconsistent before the subsequent copy operation.

962) Improper resource shutdown or release (CVE-ID: CVE-2026-72448)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the otx2_free_sq_res() send-queue resource teardown logic when tearing down a send queue with timestamping enabled. A local user can trigger interface shutdown or device removal to cause a denial of service.

Only send queues using timestamping are affected.

963) Double free (CVE-ID: CVE-2026-72449)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in kfd_criu_resume_svm() when handling a second AMDKFD_IOC_CRIU_OP request from the same process via /dev/kfd. A local user can trigger repeated cleanup of freed list entries to cause a denial of service.

The issue is reachable by an unprivileged render-group user and is caused by stale list entries left in the criu_svm_metadata_list after cleanup.

964) Out-of-bounds read (CVE-ID: CVE-2026-72450)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds shift in xfrm_selector_match and address matching helpers when processing xfrm selector matching with an AF_UNSPEC selector and an oversized prefix length. A local attacker can provide a crafted selector with a mismatched family or excessive prefix length to cause a denial of service.

The issue can be triggered when an AF_UNSPEC selector is matched against an IPv4 flow while XFRM_STATE_AF_UNSPEC is set.

965) Race condition (CVE-ID: CVE-2026-72451)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a race condition in the xfrm input state cache insertion code in xfrm_input_state_lookup() when processing xfrm input state lookups. A remote attacker can trigger concurrent state destruction during cache insertion to cause a denial of service.

966) Improper resource shutdown or release (CVE-ID: CVE-2026-72459)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in aa_label_alloc() in the AppArmor label handling code when allocating a label and the proxy allocation step fails. A local user can trigger an allocation failure condition to cause a denial of service.

967) NULL pointer dereference (CVE-ID: CVE-2026-72460)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in aa_change_profile() when building a replacement label during a profile change. A local user can trigger label build failure handling to cause a denial of service.

The issue occurs in the AppArmor profile transition logic during processing of profile change requests.

968) Use-after-free (CVE-ID: CVE-2026-72463)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in the xfrm async resumption handling in net/xfrm/xfrm_input.c when processing xfrm packets and resuming transport processing asynchronously. A remote attacker can send crafted traffic that triggers xfrm_rcv_cb to modify skb->dev and cause a denial of service.

The issue involves a race condition with tunnel device teardown and affects handling of both IPv4 and IPv6 transport finish paths.

969) Resource exhaustion (CVE-ID: CVE-2026-72464)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in rpcrdma_reply_handler() when processing malformed RPC/RDMA replies. A remote attacker can send a sustained stream of short replies or replies with an unrecognized RPC/RDMA version to cause a denial of service.

The issue can drain the client's posted Receive queue and stall the transport until reconnect.

970) Out-of-bounds read (CVE-ID: CVE-2026-72466)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read and improper resource management in rpcrdma_is_bcall() when processing a short or malformed reply. A remote attacker can send a specially crafted reply to cause a denial of service.

The issue can misclassify a reply as a backchannel call and orphan a persistently DMA-mapped receive buffer, which can drain the Receive queue and lead to RNR NAKs in the peer.

971) NULL pointer dereference (CVE-ID: CVE-2026-72467)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in rpcrdma_encode_write_list() when processing an NFS/RDMA read with a non-4-byte-aligned receive page length after a connection succeeds with a NULL write-pad memory region. A local user can trigger a connection or reconnection that hits a local memory region allocation, DMA-map, memory region map, or post-send failure to cause a denial of service.

A remote peer alone cannot force the local memory region setup failure required for exploitation.

972) Use-after-free (CVE-ID: CVE-2026-72469)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in rpcrdma_cm_event_handler() and RDMA connection teardown handling in the xprtrdma component when processing an RDMA_CM_EVENT_ADDR_CHANGE event before RDMA_CM_EVENT_ESTABLISHED. A local user can trigger crafted RDMA connection state changes to cause a denial of service.

The issue occurs because an unmatched reference decrement can underflow the kref and leave disconnect handling operating on a freed endpoint.

973) Heap-based buffer overflow (CVE-ID: CVE-2026-72470)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in the ntfs3 log replay scratch buffer handling in log_replay() and read_log_page() when mounting a dirty NTFS volume with an on-disk log page size larger than the initially allocated buffer. A local user can mount a specially crafted NTFS volume to cause a denial of service or execute arbitrary code.

Exploitation requires a dirty NTFS volume whose log records a larger page size than the mounting host initially allocated.

974) Use-after-free (CVE-ID: CVE-2026-72473)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the xprtrdma request handling logic when processing RPC-over-RDMA send and reply completion. A local user can trigger request reuse while the HCA is still DMA-reading from its send buffer to cause a denial of service.

The issue occurs for Sends carrying only pre-registered buffers, where the request could be returned to the free pool before Send-side completion.

975) Improper resource shutdown or release (CVE-ID: CVE-2026-72474)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper resource management in the dma-axi-dmac driver descriptor handling when freeing DMA descriptors from softirq context. A local attacker can trigger DMA operations that cause descriptor cleanup to invoke dma_free_coherent() in interrupt context to cause a denial of service.

The issue is observable on architectures such as Microblaze or arm64 where DMA_DIRECT_REMAP is set.

976) Use-after-free (CVE-ID: CVE-2026-72476)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in dma_release_channel() when releasing a dma channel. A local user can trigger the release of a channel whose device reference may already be freed to cause a denial of service.

977) Out-of-bounds read (CVE-ID: CVE-2026-72478)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in run_get_highest_vcn() when mounting an NTFS filesystem containing a crafted $LogFile UpdateMappingPairs record with unterminated mapping-pairs data. A remote attacker can provide a specially crafted filesystem image to cause a denial of service.

The issue is triggered during log replay on mount.

978) Use of Uninitialized Variable (CVE-ID: CVE-2026-72479)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of uninitialized memory in mma8452_read_raw() when handling a failed I2C block read in mma8452_read(). A local user can trigger an I2C read failure and cause the caller to use uninitialized stack memory to disclose sensitive information.

979) Out-of-bounds read (CVE-ID: CVE-2026-72480)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in ams_event_to_channel() and ams_handle_event() when handling device events. A local attacker can trigger an event with a non-matching scan index to cause a denial of service.

980) Use of Uninitialized Variable (CVE-ID: CVE-2026-72481)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to uninitialized memory exposure in the ak8975 magnetometer driver when processing i2c block read results that are shorter than the destination buffer. A local user can trigger the driver to forward partially uninitialized buffer contents to IIO buffers to disclose sensitive information.

The leaked data may be exposed from kernel stack memory to userspace.

981) Integer overflow (CVE-ID: CVE-2026-72483)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to a shift-out-of-bounds error in max3421_hub_control() when handling a USBDEVFS_CONTROL ioctl for the root hub with a crafted wValue parameter. A local user can send a specially crafted ioctl request to corrupt kernel memory.

Exploitation requires access to the root hub device via /dev/bus/usb/.../001.

982) Double free (CVE-ID: CVE-2026-72484)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in comp_register_videodev() when handling a video device registration failure. A local user can trigger a device_register() failure during video device registration to cause a denial of service.

The issue occurs in the Linux kernel staging MOST video driver.

983) NULL pointer dereference (CVE-ID: CVE-2026-72485)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of allocation failure in coresight platform connection management functions when processing device probe data. A local user can trigger memory allocation failure during probe cleanup to cause a denial of service.

The issue occurs because cleanup code iterates connection entries up to inconsistent counter values and dereferences NULL or uninitialized pointers, leading to a kernel panic.

984) Use-after-free (CVE-ID: CVE-2026-72486)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in the mtk-adsp mailbox driver when handling a late interrupt during device teardown after a failed SOF audio driver initialization. A local attacker can trigger a failed probe condition that leaves the IRQ line active and cause a late interrupt to access freed memory to cause a denial of service.

The crash was observed after probe failure in the SOF audio driver initialization path.

985) Out-of-bounds read (CVE-ID: CVE-2026-72487)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in pci_get_rom_size in drivers/pci/rom.c when processing a broken PCI ROM image. A local user can provide a malformed ROM layout to trigger a kernel crash and cause a denial of service.

On some arm64 systems, exploitation may instead trigger an alignment fault due to unaligned IOMEM access.

986) Use-after-free (CVE-ID: CVE-2026-72489)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in nvec_rx_completed() when handling an incomplete RX transfer. A local user can trigger an incomplete RX transfer to execute arbitrary code.

The freed message slot may be reallocated by a concurrent call to nvec_msg_alloc() before the code reads the message type byte.

987) Race condition (CVE-ID: CVE-2026-72491)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in net/9p RDMA transport state handling in trans_rdma.c when processing RDMA connection events and receive completions concurrently with RDMA requests. A local user can trigger concurrent state transitions to corrupt the connection state machine and cause a denial of service.

The race can lead to lost state transitions during teardown and may result in use-after-free on RDMA request objects.

988) Use-after-free (CVE-ID: CVE-2026-72492)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a use-after-free in same_client_has_lease() and smb_grant_oplock() when handling lease state for existing client oplocks during concurrent close operations. A remote user can trigger a concurrent close condition to cause a denial of service.

The issue occurs because a pointer selected from ci->m_op_list can be used after the last reference is dropped before it is dereferenced.

989) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-72496)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in bnxt_qplib_alloc_dpi when mapping device memory with ioremap. A local user can trigger an ioremap failure to cause a denial of service.

990) NULL pointer dereference (CVE-ID: CVE-2026-72502)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in skb_segment() when processing a local TCP packet with gso_size set to 0xFFFF. A local attacker can trigger a large MTU condition that causes the MSS clamp to reach 65535 to cause a denial of service.

The issue occurs because the 0xFFFF MSS value collides with the GSO_BY_FRAGS magic value, and local TCP packets do not use frag_list.

991) Use-after-free (CVE-ID: CVE-2026-74255)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code or cause a denial of service.

The vulnerability exists due to use-after-free in tipc_l2_send_msg() when handling TIPC layer 2 media disable operations concurrently with RCU readers. A local user can trigger concurrent access to a freed device pointer to execute arbitrary code or cause a denial of service.

The issue is caused by a race condition involving b->media_ptr and network-device lifetime management.

992) Integer overflow (CVE-ID: CVE-2026-74256)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in bpf_msg_pop_data() in the sockmap BPF message handling code when processing crafted start and len values. A local user can supply out-of-range values to trigger an out-of-bounds pop operation and cause a denial of service.

Exploitation can cause the pop loop to run past the end of the scatterlist and reach an invalid put_page() on an empty slot.

993) Improper input validation (CVE-ID: CVE-2026-74258)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in bpf_uprobe_multi_link_attach in kernel/trace/bpf_trace.c when processing user-supplied uprobe_multi array pointers. A local user can supply crafted user-space pointers to trigger a kernel fault and cause a denial of service.

The issue involves missing bounds validation with access_ok before __get_user accesses user-space data.

994) Race condition (CVE-ID: CVE-2026-74262)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in kcm_attach() and kcm_unattach() callback handling in net/kcm/kcmsock.c when changing lower socket callbacks concurrently. A local user can trigger concurrent callback updates and execution to cause a denial of service.

The issue can lead to stale or misdirected wakeups when callback and sk_user_data state become mismatched across CPUs.

995) NULL pointer dereference (CVE-ID: CVE-2026-74263)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in t7xx_port_ctrl_tx() when cloning skb fragments for the control transmit path. A local user can trigger an skb_clone() failure to cause a denial of service.

996) Improper Initialization (CVE-ID: CVE-2026-74265)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in mana_gd_create_mana_wq_cq() when handling a failed work queue and completion queue creation. A local user can trigger queue creation failure to cause a denial of service.

The issue can clear an in-use completion queue table entry by destroying a queue with an uninitialized id value of 0.

997) Improper Initialization (CVE-ID: CVE-2026-74267)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in sch_codel when peeking queued packets after packet drops. A local user can trigger packet drops during peek to cause a denial of service.

The issue can incorrectly invoke the parent qlen_notify callback while a packet still remains queued, which may deactivate the parent class unexpectedly.

998) Race condition (CVE-ID: CVE-2026-74268)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state management in tcp_set_state() and tcp_call_bpf() when force-closing a child socket whose inherited sock_ops callback flags remain set after setup failure. A remote attacker can send network traffic that triggers child socket setup failure to cause a denial of service.

The issue occurs before the child socket is ever established and affects forced-close paths that reach tcp_done() without the expected socket lock.

999) Improper access control (CVE-ID: CVE-2026-74270)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to spoof handshake completion or disrupt an in-flight handshake.

The vulnerability exists due to improper access control in handshake_nl_done_doit() and the handshake genl DONE command when submitting a DONE request for a supplied sockfd without sender authentication. A local user can send a forged DONE message with a chosen status value to spoof handshake success or tear down a legitimate handshake.

The issue affects the DONE downcall of the handshake generic netlink family, where fd lookup confirms only that a pending handshake request exists for the supplied sockfd.

1000) Out-of-bounds write (CVE-ID: CVE-2026-74271)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in __power_supply_populate_supplied_from when processing a device tree property with multiple power-supplies values. A local user can provide a crafted device tree configuration to cause a denial of service.

Exploitation requires the system to process a device tree configuration in which the power-supplies property contains multiple values.

1001) Incorrect calculation (CVE-ID: CVE-2026-74276)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper buffer size calculation in the xilinx SPI driver FIFO size detection logic when handling SPI transactions in irq mode. A local user can trigger an SPI transaction of the assumed FIFO size or more to cause a denial of service.

The issue can cause the driver to spin in a while loop forever after one received byte is lost because the RX FIFO is smaller than the incorrectly assumed size.

1002) Information disclosure (CVE-ID: CVE-2026-74278)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper exposure of sensitive information in bounce_error_event() when delivering bounce error events to a user client via snd_seq_read(). A local user can trigger delivery of a bounce error event and read the returned fixed-length event to disclose sensitive information.

The issue exposes a raw kernel heap pointer from struct snd_seq_event to userspace through copy_to_user() in the fixed-length event handling path.

1003) Improper resource shutdown or release (CVE-ID: CVE-2026-74279)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the sg_cleanup error path in setup_sgio_components() when cleaning up DMA mappings after a mapping failure. A local user can trigger the error path to cause a denial of service.

The issue leaks successfully mapped DMA entries while repeatedly unmapping the failed entry.

1004) Improper resource shutdown or release (CVE-ID: CVE-2026-74280)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the sg_cleanup path in drivers/crypto/marvell/octeontx/otx_cptvf_reqmgr.c when cleaning up DMA mappings after a setup failure. A local user can trigger the cleanup path to cause a denial of service.

The issue uses the wrong loop index during DMA unmapping, which can leak successfully mapped entries while repeatedly unmapping the failed one.

1005) Improper input validation (CVE-ID: CVE-2026-74281)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in tipc_update_nametbl() when processing peer-advertised PUBLICATION items. A remote attacker can send specially crafted bindings with inverted service ranges to cause a denial of service.

The issue causes unbounded binding-table memory to be leaked for the lifetime of the namespace.

1006) Integer underflow (CVE-ID: CVE-2026-74282)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer underflow in tipc_sk_conn_proto_rcv() when processing a CONN_MANAGER/CONN_ACK message. A remote attacker can send a specially crafted connection acknowledgment with an oversized ack count to cause a denial of service.

For a local connection, the connected peer socket can trigger the issue.

1007) Improper access control (CVE-ID: CVE-2026-74283)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to modify TIPC state.

The vulnerability exists due to improper access control in TIPCv2 generic-netlink mutator operations when handling netlink administrative commands. A local user can invoke mutating netlink operations to modify TIPC state.

The issue affects commands that can change the network id and node identity, set or flush key material, and enable or disable a UDP bearer.

1008) Race condition (CVE-ID: CVE-2026-74284)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the HFSC scheduler class handling in net/sched/sch_hfsc.c when dequeuing packets from a class whose child qdisc becomes empty. A local user can trigger packet processing that causes a class to be marked passive twice to cause a denial of service.

The issue can incorrectly remove a parent with still-backlogged sibling classes from the virtual time tree, causing queued traffic to stop being dequeued.

1009) Out-of-bounds read (CVE-ID: CVE-2026-74287)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in SCTP parameter processing when parsing malformed embedded address parameters in INIT or ASCONF messages. A remote attacker can send a specially crafted SCTP parameter with an embedded address length that exceeds the enclosing parameter bounds to disclose sensitive information.

The issue affects ADD_IP, DEL_IP, and SET_PRIMARY parameters that contain embedded address parameters.

1010) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-74288)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference count handling in fib_rules_dump() when dumping fib_rule entries during an RCU dump. A local user can trigger fib_rule processing involving a dying fib_rule to cause a denial of service.

1011) Use-after-free (CVE-ID: CVE-2026-74289)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in fib_leaf_notify() and fib_info reference handling when dumping IPv4 fib_info entries under RCU during fib notifier processing. A local user can trigger network namespace cleanup or device reload operations that invoke affected fib notifier paths to cause a denial of service.

The issue was reported through the netdevsim notifier path, and IPv6 is not affected by the same condition.

1012) Information disclosure (CVE-ID: CVE-2026-74290)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper exposure of sensitive information in the cls_flow classifier when processing class statistics for map mode rules with user-controlled mask, xor, rshift, addend, and divisor values. A remote user can create a tc classifier and observe the resulting classid through class statistics to disclose sensitive information.

Exploitation requires the ability to use a tc classifier in a user or network namespace.

1013) Out-of-bounds read (CVE-ID: CVE-2026-74291)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the ASoC topology parser when parsing a malformed topology blob with non-NUL-terminated PCM, DAI, or stream capability name fields. A local user can supply a specially crafted topology blob to disclose sensitive information.

1014) Out-of-bounds read (CVE-ID: CVE-2026-74292)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in tegra_ahub_put_value_enum() in the tegra210 AHUB ASoC driver when processing a written enumerated control value. A local user can supply an out-of-range enum item value to disclose sensitive information.

1015) Improper input validation (CVE-ID: CVE-2026-74293)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in fsl_audmix_put_mix_clk_src() and fsl_audmix_put_out_src() in the fsl_audmix ASoC driver when handling user-provided enum control values. A local user can supply an out-of-range enum item to cause a denial of service.

The invalid value is converted before bounds checking, and the affected code paths use the converted value in a BIT() test and as an index into a transition table.

1016) Improper input validation (CVE-ID: CVE-2026-74294)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the AIU HDMI and internal codec mux put callbacks when processing written enumerated control values. A local user can supply an out-of-range enum value to cause a denial of service.

1017) Out-of-bounds read (CVE-ID: CVE-2026-74295)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the hdac_hdmi_set_pin_port_mux() function when handling a written enumerated control value. A local user can supply an out-of-range enum value to disclose sensitive information.

1018) Improper resource shutdown or release (CVE-ID: CVE-2026-74296)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the RDMA/mlx5 UAR deallocation logic when releasing a user access region index. A local user can trigger UAR allocation and release operations to cause a denial of service.

1019) Integer overflow (CVE-ID: CVE-2026-74297)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in set_rq_size() in the RDMA/mlx5 queue pair handling code when processing a user-provided rq_wqe_shift value. A local user can supply a crafted shift value to trigger undefined behavior and cause a denial of service.

1020) Out-of-bounds read (CVE-ID: CVE-2026-74300)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in hci_read_codec_capabilities() when parsing a malformed controller response containing truncated codec capability elements. A remote attacker can send a specially crafted controller response to disclose sensitive information.

The issue occurs because the parser validates only the payload length and can record a two-byte capability after receiving only one payload byte.

1021) Use-after-free (CVE-ID: CVE-2026-74302)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in hci_unregister_dev() when a timeout fires during device teardown. A local user can trigger device teardown and a timer callback to dereference freed memory to cause a denial of service or execute arbitrary code.

The freed memory may include the hdev->reset function pointer.

1022) NULL pointer dereference (CVE-ID: CVE-2026-74303)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in qca_dmp_hdr() in the hci_qca Bluetooth driver when handling a non-serdev device path. A local attacker can trigger the vulnerable code path to cause a denial of service.

The issue affects hci_uart attached through non-serdev paths.

1023) Improper access control (CVE-ID: CVE-2026-74305)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass intended cgroup storage compatibility checks.

The vulnerability exists due to improper access control in bpf prog-array compatibility checks when validating tail-call chains involving cgroup local storage. A local user can load a storage-less BPF program that performs tail calls to bridge between programs with incompatible storage cookies to bypass intended cgroup storage compatibility checks.

Exploitation requires the ability to load and use BPF programs that participate in tail-call chains.

1024) Deadlock (CVE-ID: CVE-2026-74307)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in EXT4_IOC_MOVE_EXT when processing a donor file descriptor that refers to a file on a different filesystem. A local user can supply a donor file from a different superblock to cause a denial of service.

Exploitation requires a concurrent filesystem freeze operation to trigger the deadlock cycle.

1025) Improper input validation (CVE-ID: CVE-2026-74308)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state validation in ext4_journalled_write_end() and ext4_write_inline_data_end() when handling writes on an ext4 filesystem mounted with the data=journal option after a failed inline-data-to-extent conversion. A local user can trigger a crafted write operation to cause a denial of service.

The issue can be triggered when a previous attempt to convert inline data to an extent fails, such as due to insufficient space.

1026) Use-after-free (CVE-ID: CVE-2026-74310)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in vhost_zerocopy_complete in the vhost/net subsystem when processing zerocopy TX descriptor completion callbacks for cloned skbs. A local user can trigger cloned skb completion callbacks to dereference freed ubuf state and cause a denial of service.

Exploitation requires delayed completion after backend removal while another cloned skb reference still carries the same ubuf_info.

1027) Out-of-bounds read (CVE-ID: CVE-2026-74312)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds access in vhost_vdpa_mmap() and vhost_vdpa_fault() when processing a virtqueue index from vm_pgoff. A local user can provide an out-of-range queue index to trigger driver-specific get_vq_notification() callbacks and cause a denial of service.

The issue may lead to invalid PFN remaps in the callback path.

1028) Use-after-free (CVE-ID: CVE-2026-74313)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in vduse_dev_open() when opening a VDUSE device while a concurrent VDUSE_DESTROY_DEV operation removes the same device from the IDR. A local user can trigger concurrent operations on the same device to cause a denial of service.

1029) Deadlock (CVE-ID: CVE-2026-74318)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock condition in the btrfs reflink inline extent cloning logic when cloning an inline extent to a destination offset greater than zero while the filesystem is mounted with flushoncommit. A local user can trigger crafted reflink and write activity to cause a denial of service.

The issue occurs when inline extent data is copied into a destination file beyond its current end of file, leading transaction commit and folio invalidation paths to wait on the same extent lock.

1030) Use-after-free (CVE-ID: CVE-2026-74320)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the sm501fb OF binding code when parsing device tree mode and EDID properties during framebuffer initialization. A local user can supply crafted property values or trigger affected initialization paths to cause a denial of service.

The issue also involves a double free, a buffer overrun, and memory leaks when both CRT and PANEL are enabled or when probe error paths are reached.

1031) NULL pointer dereference (CVE-ID: CVE-2026-74321)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an invalid pointer dereference in __btrfs_run_delayed_refs() when processing delayed references. A local user can trigger the vulnerable code path to cause a denial of service.

1032) NULL pointer dereference (CVE-ID: CVE-2026-74327)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in is_vm_area_hugepages() when handling an invalid vmalloc address. A local attacker can provide an invalid vmalloc address to trigger a kernel crash to cause a denial of service.

1033) Use-after-free (CVE-ID: CVE-2026-74329)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in watchdog_pm_notifier in the Linux kernel watchdog subsystem when processing suspend and resume notifications after watchdog device unregistration. A local user can trigger a suspend or resume event after unregistering a watchdog device to cause a denial of service.

Only watchdog devices with WDOG_NO_PING_ON_SUSPEND set are affected.

1034) Race condition (CVE-ID: CVE-2026-74330)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in configfs directory entry child traversal when traversing s_children lists while concurrent cursor movement or freeing can occur. A local user can trigger concurrent configfs operations to cause a denial of service.

The issue affects configfs directory handling in fs/configfs/dir.c.

1035) Deadlock (CVE-ID: CVE-2026-74331)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a recursive locking deadlock in firmware_loader power management notification handling when preparing for system suspend or hibernation and caching firmware images. A local attacker can trigger an out-of-memory condition that causes synchronous execution of firmware caching work to cause a denial of service.

The issue occurs when asynchronous work scheduling falls back to synchronous execution after memory allocation for the work entry fails.

1036) Race condition (CVE-ID: CVE-2026-74334)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the RDMA nldev resource tracking code when accessing memory region protection domain data during memory region re-registration. A local user can trigger concurrent memory region re-registration and netlink resource access to cause a denial of service.

The issue involves user memory regions whose protection domain pointer can change during in-place re-registration.

1037) Use of Uninitialized Variable (CVE-ID: CVE-2026-74339)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper initialization in snd_seq_read() when copying queued variable-length event headers to userspace. A local user can write a direct variable event to itself and read back a kernel pointer from the returned header to disclose sensitive information.

The issue affects ALSA sequencer variable-length events that use SNDRV_SEQ_EXT_CHAINED internally.

1038) Out-of-bounds read (CVE-ID: CVE-2026-74340)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in the wcn36xx_smd_print_reg_info_ind function when processing a firmware PRINT_REG_INFO indication. A remote attacker can provide a firmware-controlled count value that exceeds the actual message data to disclose sensitive information.

The issue occurs because the count field is used as a loop bound for indexing a flexible regs[] array without validation against the received message length.

1039) Heap-based buffer overflow (CVE-ID: CVE-2026-74341)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in the wcn36xx HAL response dispatcher when processing an oversized firmware HAL response. A local user can provide a firmware response with an excessive length to cause a denial of service.

The copied data is firmware-controlled content written into a 4096-byte buffer.

1040) Use-after-free (CVE-ID: CVE-2026-74345)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in the RDMA/siw connection management endpoint handling code when processing a malformed MPA request during connection establishment. A remote attacker can send a malformed MPA request to cause a denial of service.

The issue is triggered when the new endpoint is closed during connection establishment.

1041) Out-of-bounds read (CVE-ID: CVE-2026-74346)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in irdma_handle_q_mem during CQ memory registration when processing CQ page array data. A local user can trigger CQ MR registration with a crafted page layout to disclose sensitive information.

The issue affects GEN_2 hardware and later when the CQ resize feature is enabled.

1042) Use-after-free (CVE-ID: CVE-2026-74347)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a use-after-free in the netfilter conntrack timeout policy handling when removing a timeout policy while conntrack entries or queued packets still reference it. A local privileged user can delete a referenced timeout policy to cause a denial of service.

Exploitation requires the ability to manage conntrack timeout policies in netfilter.

1043) Use-after-free (CVE-ID: CVE-2026-74348)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ocfs2 dlm locking_state debugfs open and release handling when opening the locking_state debugfs file during concurrent domain teardown. A local user can open and later close the debugfs file to cause a denial of service.

The issue occurs when the open path stores a raw dlm_ctxt pointer even if acquiring a reference fails, and the release path later accesses that context after it has been freed.

1044) Integer underflow (CVE-ID: CVE-2026-74349)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause unintended block trimming beyond the requested range.

The vulnerability exists due to an integer underflow in ocfs2_trim_mainbm() when processing a FITRIM range shorter than a cluster. A local user can submit a specially crafted FITRIM range to cause unintended block trimming beyond the requested range.

The issue occurs on filesystems where the cluster size is larger than the block size.

1045) Out-of-bounds read (CVE-ID: CVE-2026-74350)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the ocfs2 fast symlink read path when processing a malformed zero-cluster symlink inode. A local user can provide a crafted filesystem image containing an invalid fast symlink to disclose sensitive information.

The issue is triggered when the inline symlink payload is not NUL-terminated at the recorded size or when the recorded size exceeds the inline fast-symlink capacity.

1046) Use-after-free (CVE-ID: CVE-2026-74351)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a use-after-free in the ocfs2 locking_state debugfs iterator when dumping raw LVB bytes from a copied lock resource after lockres teardown. A local user can read the debugfs locking_state output during a concurrent teardown to disclose sensitive information.

The issue occurs because a copied non-NULL sb_lvbptr can continue to reference the original lock resource after the tracking lock is dropped.

1047) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-74356)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in vhost_get_avail_idx in the vhost subsystem when handling available ring entries with mergeable buffers enabled. A local user can trigger repeated processing of available entries to cause a denial of service.

The issue can lead to a host livelock when the guest is not making progress and notifications are re-enabled while entries remain in the ring.

1048) Use-after-free (CVE-ID: CVE-2026-74359)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in configfs_lookup() when handling subsequent getdents(2) operations in a directory after inode allocation failure. A local user can trigger inode allocation failure and then access the affected directory to cause a denial of service.

The issue occurs because a dangling pointer remains in the configfs_dirent structure and is later dereferenced to obtain an inode number.

1049) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-74362)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect success status reporting for failed synchronous writes.

The vulnerability exists due to improper check for unusual or exceptional conditions in ext2_dio_write_iter() in fs/ext2/file.c when handling direct I/O writes to O_SYNC/O_DSYNC files. A local user can trigger a failed sync during a write operation to cause incorrect success status reporting for failed synchronous writes.

The issue affects error propagation from generic_write_sync() and may also involve filemap_write_and_wait_range() handling.

1050) Use-after-free (CVE-ID: CVE-2026-74363)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in bpffs inode handling when a concurrent unlinkat() drops the last inode reference during RCU path walking. A local user can trigger concurrent path operations to cause a denial of service.

The issue occurs because inode fields and the cached symlink body may still be accessed during RCU pathwalk after the inode is freed.

1051) Race condition (CVE-ID: CVE-2026-74365)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause silent data corruption.

The vulnerability exists due to a race condition in BTT lane acquisition in the Linux kernel nvdimm BTT subsystem when handling BTT I/O. A local user can trigger concurrent use of the same lane to cause silent data corruption.

The issue occurs because BTT lanes became preemptible while the recursion model still relied on a per-CPU recursion count, allowing another task on the same CPU to bypass locking and use the same lane concurrently.

1052) Improper resource shutdown or release (CVE-ID: CVE-2026-74376)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the md/raid10 discard handling logic when reusing an r10bio for discard operations. A local user can trigger discard operations on a reused r10bio to cause a denial of service.

The issue occurs when a discard reuses an r10bio that was previously used for a read, leaving read_slot non-negative and causing cleanup to skip releasing the replacement bio.

1053) Out-of-bounds read (CVE-ID: CVE-2026-74377)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in rxe_resp_check_length() and copy_data() when processing a receive WQE from a shared queue buffer mapped into userspace. A local user can modify WQE fields such as num_sge or sge entries during processing to cause an out-of-bounds read.

The issue affects the non-SRQ queue pair receive path.

1054) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-74378)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a heap-based buffer overflow.

The vulnerability exists due to a time-of-check time-of-use race in get_srq_wqe() when copying a work queue element from a shared receive queue buffer mapped into userspace. A local user can modify num_sge between validation and size calculation to cause a heap-based buffer overflow.

The issue arises because the num_sge field is read twice from shared userspace-accessible memory.

1055) NULL pointer dereference (CVE-ID: CVE-2026-74379)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in dev_dax_kmem_remove() when removing dax kmem ranges after partial success during probing. A local user can trigger removal of a device with ranges whose resources were never added to cause a denial of service.

The issue occurs when dev_dax_kmem_probe() partially succeeds and later probe failures leave some range resources unset while removal still iterates over all ranges.

1056) Incorrect Check of Function Return Value (CVE-ID: CVE-2026-74380)

CWE-ID: CWE-253 - Incorrect Check of Function Return Value

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of error return values in pin_job() in the host1x GPU driver when mapping scatter-gather tables through the IOMMU. A local user can trigger the affected code path to cause a denial of service.

The issue involves assigning the iommu_map_sgtable() result to an incorrect integer type, which can turn error conditions into negative overflowed values.

1057) Resource management error (CVE-ID: CVE-2026-74381)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference count management in host1x buffer object cache handling when pinning and caching buffer object mappings. A local user can trigger caching of a buffer object mapping to cause a denial of service.

The issue stems from a circular reference between cached mappings and the underlying buffer object, which can prevent the buffer object from being freed.

1058) Uncontrolled Recursion (CVE-ID: CVE-2026-74382)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in cls_bpf_offload_cmd() in the cls_bpf traffic control offload path when processing a filter replace operation and attempting rollback after repeated tc_setup_cb_replace() failures. A local user can trigger repeated rollback failures to cause a denial of service.

The issue can exhaust kernel stack space during rollback handling, and it is not limited to netdevsim.

1059) Out-of-bounds write (CVE-ID: CVE-2026-74384)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the nvme multipath namespace head flexible array member current_path[] when handling sparse NUMA node IDs during namespace path revalidation. A local user can trigger nvme multipath operations on a system with sparse NUMA node IDs to cause a denial of service.

Only systems using nvme multipath on architectures where NUMA node IDs are sparse are affected.

1060) Improper resource shutdown or release (CVE-ID: CVE-2026-74386)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in nvmet_tcp_alloc_queue() in the NVMe target TCP component when handling connection closure during queue allocation. A remote attacker can repeatedly open and close connections to cause a denial of service.

The issue occurs on an error path where the page fragment cache reference held by queue->pf_cache is not released, leading to a page leak over time.

1061) Use-after-free (CVE-ID: CVE-2026-74387)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in the ALSA sequencer MIDI output handling in sound/core/seq/seq_midi.c when processing MIDI sequencer events during concurrent output teardown. A local user can trigger concurrent event processing and output teardown to cause a denial of service or execute arbitrary code.

The issue occurs because the event_input path can keep using a stale substream or runtime after the last unuse path releases the rawmidi file.

1062) Logging of Excessive Data (CVE-ID: CVE-2026-74389)

CWE-ID: CWE-779 - Logging of Excessive Data

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper restriction of excessive logging in the hns roce rdma driver command error handling path when command mailbox failures are repeatedly triggered during hardware context operations. A local user can trigger repeated command failures to cause a denial of service.

The issue can lead to log flooding after command mailbox failures and may result in a system crash when the hardware is abnormal.

1063) Out-of-bounds write (CVE-ID: CVE-2026-74390)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to out-of-bounds write in irdma_copy_user_pgaddrs when processing user-supplied RDMA memory registration data with lvl set to 0. A local user can provide a umem with more DMA blocks than the supplied page count to cause a denial of service or execute arbitrary code.

The issue affects the lvl==0 case that uses the fixed-size iwmr->pgaddrmem array for QP, CQ, and SRQ rings.

1064) Stack-based buffer overflow (CVE-ID: CVE-2026-74391)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in synthetic field helpers in kernel/trace/trace_events_hist.c when constructing synthetic variable names and generated histogram commands from long key lists, field names, or saved filters. A local user can supply crafted tracing inputs to cause a denial of service.

The issue occurs in tracing functionality while building fixed-size MAX_FILTER_STR_VAL staging buffers.

1065) Integer overflow (CVE-ID: CVE-2026-74394)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow in the immediate data length check in the RDMA/srpt subsystem when processing user-supplied immediate data received over the network. A remote attacker can send a specially crafted network request with an oversized length value to cause a denial of service.

The length field is user-controlled and may wrap the computed request size, bypassing the bounds check before a very large length is passed to sg_init_one().

1066) NULL pointer dereference (CVE-ID: CVE-2026-74395)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT in drivers/infiniband/hw/mlx5/devx.c when handling devx subscribe-event requests and unwinding an error after eventfd acquisition fails. A local user can trigger the error path with a crafted subscribe-event request to cause a denial of service.

The issue occurs because the subscription object is linked into the pending list before fields needed by cleanup are initialized.

1067) Improper resource shutdown or release (CVE-ID: CVE-2026-74397)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in mlx5_ib_alloc_transport_domain() when handling transport-domain allocation failures during loopback enablement. A local user can trigger an error path that leaks a transport domain to cause a denial of service.

The issue affects the IB/mlx5 driver in the Linux kernel.

1068) Race condition (CVE-ID: CVE-2026-74398)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a race condition in addrconf_dad_failure in the IPv6 address configuration subsystem when handling duplicate address detection failure processing concurrently with IPv6 address deletion. A local attacker can trigger concurrent state transitions to cause a denial of service.

The issue can lead to a general protection fault when a deleted IPv6 address entry is processed a second time through scheduled DAD work.

1069) Out-of-bounds read (CVE-ID: CVE-2026-74399)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in evm_read_xattrs() when reading the list of enabled EVM xattrs. A local user can trigger a read of the xattrs interface to disclose sensitive information.

The issue occurs when no configured xattrs are enabled, leaving the buffer uninitialized before its length is determined.

1070) Use-after-free (CVE-ID: CVE-2026-74401)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the DLM send_queue handling in fs/dlm/midcomms.c when processing a high volume of DLM messages. A local user can trigger heavy DLM message activity to cause a denial of service.

The issue occurs when message sequence numbers in the ordered send queue are not assigned in the required order, leading to refcounting problems.

1071) Improper Initialization (CVE-ID: CVE-2026-74402)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to obtain insufficiently random entropy.

The vulnerability exists due to improper buffer management in the atmel-sha204a hardware random number generator driver when reading random data from the device response buffer. A local user can read from /dev/hwrng to obtain insufficiently random entropy.

The issue affects both the blocking and non-blocking rng paths.

1072) NULL pointer dereference (CVE-ID: CVE-2026-74406)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in vxlan_gro_prepare_receive() when processing packets during GRO handling. A local attacker can trigger concurrent socket state changes to cause a denial of service.

1073) Out-of-bounds read (CVE-ID: CVE-2026-74408)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in ath_tx_edma_tasklet() when processing a firmware-provided tx status queue ID. A local attacker can provide an invalid queue ID value to trigger an out-of-bounds array access and cause a denial of service.

1074) Out-of-bounds read (CVE-ID: CVE-2026-74410)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in rtw_pci_rx_napi() when processing firmware RX descriptors on the PCIe transport path. A local attacker can provide a crafted descriptor with a length value that exceeds the DMA buffer size to disclose sensitive information.

The issue occurs because the computed receive length can exceed the size of the pre-allocated DMA buffer before data is copied.

1075) Integer overflow (CVE-ID: CVE-2026-74411)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer truncation in rtw89_update_6ghz_rnr_chan when processing 6 GHz scan parameters. A local user can trigger Wi-Fi scanning with a large number of 6 GHz parameters to cause a denial of service.

The issue can result in a kernel soft lockup during 6 GHz Wi-Fi scanning and may lead to a system panic.

1076) Improper resource shutdown or release (CVE-ID: CVE-2026-74416)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in radeon_ring_restore() when handling a failed ring lock during GPU reset. A local user can trigger repeated GPU resets that fail at the lock stage to cause a denial of service.

The issue leaks the ring backup buffer on each failed restore attempt, leading to cumulative kernel memory exhaustion during repeated GPU resets.

1077) Integer overflow (CVE-ID: CVE-2026-74417)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in radeon_align_pitch() when creating a dumb buffer. A local user can supply crafted width or bits-per-pixel values to cause a denial of service.

The issue can result in an invalid pitch or a zero-sized dumb buffer.

1078) NULL pointer dereference (CVE-ID: CVE-2026-74424)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in fbcon_new_modelist() and related fbcon console handling in drivers/video/fbdev/core/fbcon.c when processing framebuffer modelist changes for a console without vc_data. A local user can trigger a modelist change on such a console to cause a denial of service.

The issue occurs when fb_display[i].mode remains set after the associated console data has been freed.

1079) NULL pointer dereference (CVE-ID: CVE-2026-74426)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in afs_get_tree() when handling a mount operation with a non-null dyn_root context. A local user can trigger the vulnerable code path to cause a denial of service.

1080) Improper resource shutdown or release (CVE-ID: CVE-2026-74427)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper shutdown handling in the afs network namespace preallocation work logic when tearing down an afs network namespace. A local user can trigger network namespace teardown to cause a denial of service.

The issue involves cancellation and requeue behavior of the preallocated rxrpc call, connection, and peer charger while incoming calls are being disabled.

1081) Memory leak (CVE-ID: CVE-2026-74432)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in rxrpc_recvmsg() when handling recvmsg calls with MSG_PEEK on an already released call. A local user can invoke recvmsg with MSG_PEEK to cause a denial of service.

1082) NULL pointer dereference (CVE-ID: CVE-2026-74435)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in rxrpc_verify_data in net/rxrpc/recvmsg.c when processing RxRPC message data with an unallocated decode buffer. A local user can trigger a call path that reaches skb_copy_bits() with a NULL destination to cause a denial of service.

1083) Use-after-free (CVE-ID: CVE-2026-74436)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in rxrpc_kernel_charge_accept() and the rxrpc service backlog handling when concurrent socket teardown and kernel accept preallocation occur. A local attacker can trigger concurrent operations that reuse a freed backlog structure to cause a denial of service.

The issue arises from a race condition between kernel preallocation work and socket teardown in the RxRPC subsystem.

1084) Use of insufficiently random values (CVE-ID: CVE-2026-74438)

CWE-ID: CWE-330 - Use of Insufficiently Random Values

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to obtain insufficiently random data.

The vulnerability exists due to improper implementation in sun4i_ss_prng_generate() in the sun4i_ss_prng rng implementation when generating random bytes through the AF_ALG "rng" algorithm interface. A local user can request random output to obtain insufficiently random data.

The function rounds the destination length down and does not wait for the hardware to be ready before reading bytes.

1085) Stack-based buffer overflow (CVE-ID: CVE-2026-74438)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code or cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in sun4i_ss_prng_seed() in the sun4i_ss_prng rng implementation when processing a seed supplied through the AF_ALG "rng" algorithm interface. A local user can supply an oversized seed to trigger memory corruption and execute arbitrary code or cause a denial of service.

The vulnerable code path is described as only theoretically usable via the "rng" algorithm type of AF_ALG.

1086) Race condition (CVE-ID: CVE-2026-74439)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in device_pasid_table_teardown() when tearing down scalable-mode context entries. A local user can trigger teardown of a PASID table entry to cause a denial of service.

The issue arises because hardware may fetch a torn entry while the Present bit remains set, which can result in spurious faults or stale walks to freed memory.

1087) Race condition (CVE-ID: CVE-2026-74440)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read or write memory being moved.

The vulnerability exists due to a race condition in xe_exec_ioctl() when scheduling user jobs that use external buffer objects mapped by the VM without waiting on their dma-resv KERNEL fences. A local user can submit a job using an external buffer object while a kernel operation on that buffer object is still in flight to read or write memory being moved.

Long-running mode is excluded from this behavior.

1088) Use-after-free (CVE-ID: CVE-2026-74441)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the UCSI port unregistration logic when tearing down UCSI connector ports with pending partner work items. A local user can trigger port unregistration while delayed work remains pending to cause a denial of service.

The issue can also involve a double release of resources caused by work items being scheduled again while already pending.

1089) Out-of-bounds write (CVE-ID: CVE-2026-74443)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to modify authenticated command fields.

The vulnerability exists due to an out-of-bounds write in vmw_cmd_dma() in the vmwgfx command verifier when processing a dma command with an undersized header body size. A local user can submit a specially crafted command to modify authenticated command fields.

The issue arises from a suffix pointer underflow that can clobber fields in a previously relocated command in the device-visible command stream.

1090) Out-of-bounds read (CVE-ID: CVE-2026-74444)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in vmw_cmd_draw() when processing a user-supplied command stream containing an undersized DRAW_PRIMITIVES header. A local user can supply a crafted command stream to disclose sensitive information.

The issue is triggered when header->size is smaller than the command body size, causing an unsigned subtraction to wrap and a subsequent bounds check to be bypassed.

1091) NULL pointer dereference (CVE-ID: CVE-2026-74445)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in vmw_cmd_dx_bind_query() when processing an execbuf command stream containing a SVGA_3D_CMD_DX_BIND_QUERY opcode with dx_context_handle set to SVGA3D_INVALID_ID. A local user can submit a specially crafted execbuf to cause a denial of service.

The issue can be triggered from a render-node file descriptor.

1092) Race condition (CVE-ID: CVE-2026-74446)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a race condition in kfd_criu_checkpoint_events() in the amdkfd event handling code when checkpointing CRIU events while concurrent event create or destroy operations occur. A local user can trigger concurrent event insertion or removal to cause a denial of service or execute arbitrary code.

Exploitation requires a second thread in the same process to race event creation or destruction with the checkpoint operation.

1093) Improper resource shutdown or release (CVE-ID: CVE-2026-74448)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in pqm_create_queue() when handling a failure during the first queue creation for a process with MES enabled. A local user can trigger queue creation failures to cause a denial of service.

Only systems with MES enabled are vulnerable, and the issue occurs when kernel memory allocation fails during the first queue creation for a process.

1094) Use-after-free (CVE-ID: CVE-2026-74450)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the amdgpu pp_table sysfs handling when copying the power table after dropping adev->pm.mutex. A local user can trigger a concurrent pp_table write during the copy to cause a denial of service.

The issue arises because a driver-owned power table pointer is returned and later used by the sysfs path after the mutex is released.

1095) Improper input validation (CVE-ID: CVE-2026-74453)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in validate_tile_binning_config when processing tile binning configurations with oversized tile state arrays. A local user can submit a crafted tile binning configuration that leaves no room for the tile allocation pool to cause a denial of service.

The tile state data array size is derived from tile count fields and shares the same buffer slot with the tile allocation pool.

1096) Improper Initialization (CVE-ID: CVE-2026-74453)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in the vc4 tile state data array handling when submitting crafted tile binning configurations. A local user can submit a crafted job that reuses stale tile state data to cause a denial of service.

The issue can result in invalid command streams, invalid primitive streams, and GPU hangs.

1097) Out-of-bounds write (CVE-ID: CVE-2026-74454)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt memory and cause a denial of service.

The vulnerability exists due to an out-of-bounds write in vc4_overflow_mem_work() when handling a binner out-of-memory event. A local user can trigger a GPU job overflow to corrupt memory and cause a denial of service.

The issue arises because the GPU is authorized to DMA beyond the intended 512KB overflow slot, potentially overwriting in-flight job data and unrelated CMA memory.

1098) Improper input validation (CVE-ID: CVE-2026-74455)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper input validation in pcan_usb_fd_decode_buf() and CAN message decoding in the peak_usb USB CAN receive path when processing crafted uCAN records in a USB receive buffer. A local attacker can supply malformed record lengths to trigger kernel message rejection and cause a denial of service.

1099) Double free (CVE-ID: CVE-2026-74456)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in peak_usb_start() in the peak_usb CAN USB driver when handling a failed URB submission. A local user can trigger the vulnerable error path to cause a denial of service.

The issue occurs because the transfer buffer is freed explicitly after URB submission failure and then freed again when the URB is released.

1100) Out-of-bounds read (CVE-ID: CVE-2026-74457)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in pcan_usb_pro_handle_canmsg() and pcan_usb_pro_handle_error() when processing a crafted USB device payload. A local attacker can supply channel index values outside the bounds of usb_if->dev[] to cause a denial of service.

The channel control index is derived from device-supplied fields and values 2 through 15 exceed the two-entry usb_if->dev[] array, which can lead to a kernel panic in IRQ context.

1101) Out-of-bounds read (CVE-ID: CVE-2026-74458)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read and buffer overflow risk in kvaser_usb_leaf_wait_cmd() and the bulk receive path when parsing device-provided variable-length commands from a USB buffer. A local attacker can supply a crafted command with an invalid length to cause a denial of service.

The issue affects command handling for nonzero commands that are shorter than the fixed header or that extend beyond the current USB buffer item.

1102) Improper resource shutdown or release (CVE-ID: CVE-2026-74459)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in es58x_read_bulk_callback() in the etas_es58x CAN USB driver when handling a failed RX URB resubmission. A local user can trigger a URB resubmission failure to cause a denial of service.

1103) Out-of-bounds read (CVE-ID: CVE-2026-74460)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in ems_usb_read_bulk_callback() in the ems_usb CAN USB driver when processing crafted CPC messages in a USB receive buffer. A local attacker can supply a crafted CPC message with an invalid length to cause a denial of service.

1104) Use-after-free (CVE-ID: CVE-2026-74461)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the i2c-imx slave timeout handling in drivers/i2c/busses/i2c-imx.c when unregistering a slave device while a pending interrupt has already started the hrtimer. A local user can trigger the race condition to cause a denial of service.

The issue can also result in a NULL pointer dereference when the timer callback invokes the slave event handler with a NULL slave pointer.

1105) Deadlock (CVE-ID: CVE-2026-74463)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock in the jz4780 i2c bus driver when handling concurrent i2c transfers involving clock framework operations. A local user can trigger concurrent bus activity to cause a denial of service.

The issue can freeze the system because of a circular dependency between the common clock framework prepare_lock mutex and the i2c adapter lock.

1106) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-74464)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in ovs_flow_key_update() handling within net/openvswitch/actions.c when processing connection tracking actions on a packet whose flow key becomes invalid and unparseable. A local user can trigger flow key update failure with a specially crafted packet and action sequence to cause a denial of service.

This requires the packet to become unparseable after actions are applied to a previously parseable skb.

1107) Use-after-free (CVE-ID: CVE-2026-74465)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the openvswitch meter handling code when processing crafted netlink requests through the uAPI. A local user can trigger meter attach failure conditions and concurrently access the freed meter to cause a denial of service.

Exploitation is possible with a custom application using the uAPI, while the issue is not triggered in the typical ovs-vswitchd usage pattern described in the advisory.

1108) Improper access control (CVE-ID: CVE-2026-74467)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to invoke private ioctl commands.

The vulnerability exists due to improper access control in qeth_siocdevprivate when handling SIOCDEVPRIVATE ioctl commands. A local user can invoke private ioctl commands to invoke private ioctl commands.

The issue affects the SIOC_QETH_ADP_SET_SNMP_CONTROL, SIOC_QETH_GET_CARD_TYPE, and SIOC_QETH_QUERY_OAT commands.

1109) Improper locking (CVE-ID: CVE-2026-74468)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock type selection in the pch_irq_type() callback and gpio-pch register locking logic when configuring IRQ trigger types on PREEMPT_RT kernels. A local user can trigger IRQ type configuration in a non-sleepable context to cause a denial of service.

The issue occurs on PREEMPT_RT kernels because a regular spinlock_t may become an rtmutex-backed sleeping lock in atomic context.

1110) Out-of-bounds write (CVE-ID: CVE-2026-74469)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in SCTP sock_diag when processing a diagnostic dump after adding many unique peer transports. A local user can add unique peer addresses until the 16-bit transport_count wraps and trigger a diagnostic dump to cause a denial of service.

The issue occurs when the association accumulates 65,536 unique peer transports, causing transport_count to wrap to zero while peer addresses are still copied from transport_addr_list.

1111) Out-of-bounds write (CVE-ID: CVE-2026-74470)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the resp_report_zones() function in the scsi_debug driver when processing a REPORT ZONES command with a crafted allocation length on 32-bit systems. A local user can send a specially crafted REPORT ZONES command to cause a denial of service.

The issue occurs when an allocation length in the 0xFFFFFFC1 through 0xFFFFFFFF range causes a zero-sized allocation to be dereferenced on 32-bit systems.

1112) Use-after-free (CVE-ID: CVE-2026-74471)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in trace_module_add_events() and the tracing subsystem when handling failed event registration during module loading. A local user can load a module that triggers event registration failure and subsequently access tracefs or tracing operations to cause a denial of service.

Exploitation requires a module loading scenario in which event registration fails and the module memory is later freed, leaving a stale trace_event_call pointer in trace_event_file.

1113) Improper input validation (CVE-ID: CVE-2026-74472)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in ublk_ctrl_add_dev() when copying user-supplied dev_info fields. A local user can supply crafted state values to trigger a kernel oops and cause a denial of service.

A crafted ublksrv_pid value can also cause GET_DEV_INFO to report an unrelated task as the ublk server.

1114) Out-of-bounds read (CVE-ID: CVE-2026-74473)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in route_shortcircuit() in drivers/net/vxlan/vxlan_core.c when processing packets with a non-linear buffer layout. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue occurs because the network header may not be fully pulled into the linear buffer before ip_hdr(skb)->daddr or ipv6_hdr(skb)->daddr is dereferenced.

1115) Out-of-bounds read (CVE-ID: CVE-2026-74474)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the vxlan transmit path header handling in vxlan_xmit(), arp_reduce(), and vxlan_mdb_entry_skb_get() when processing crafted socket buffers. A local user can provide a specially crafted skb layout to cause a denial of service.

The issue occurs because network-layer header availability is checked without accounting for the MAC header offset during transmit processing.

1116) Race condition (CVE-ID: CVE-2026-74475)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a race condition in route_shortcircuit() in the VXLAN implementation when processing neighbour hardware addresses. A local attacker can trigger concurrent updates to cause a denial of service.

1117) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-74476)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of non-linear skb fragment metadata in veth_convert_skb_to_xdp_buff() when processing frag_list skbs before exposing them to XDP. A local user can trigger processing of a crafted non-linear skb with frag_list data to cause a denial of service.

The issue can lead to a crash in memcpy() from __xsk_rcv() in AF_XDP copy mode.

1118) Use-after-free (CVE-ID: CVE-2026-74478)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in vector_mmsg_rx() when processing packets with an overlay header that fails verification. A remote attacker can send a specially crafted packet to cause a denial of service.

Only GRE and L2TPv3 transports are affected, and exploitation can be triggered on a cookie or session-id mismatch without authentication.

1119) Use-after-free (CVE-ID: CVE-2026-74479)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the pktgen proc entry handling in net/core/pktgen.c when concurrently removing and renaming pktgen devices. A local user can trigger a race condition involving proc_remove() on a stale proc_dir_entry to cause a denial of service.

The issue occurs because pktgen_change_name() and pktgen_remove_device() access the same proc entry with inconsistent locking, and exploitation requires winning a race between those paths.

1120) Use-after-free (CVE-ID: CVE-2026-74480)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in br_multicast_leave_group() in the bridge multicast handling code when processing fast-leave operations on port groups. A local user can trigger deletion of a matching port group to cause a denial of service.

The issue can occur when multicast-to-unicast had been enabled, allowing multiple port groups for the same port and group with different source MAC addresses, and is later disabled so entries are matched by port only.

1121) Use-after-free (CVE-ID: CVE-2026-74481)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in page_reporting_process and virtballoon_free_page_report when page reporting work continues during power management freeze while virtqueues are being deleted. A local user can trigger suspend or hibernation activity while freed pages are being reported to access deleted virtqueues and cause a denial of service.

The issue can be reached during S3 suspend or S4 hibernation, including cases where memory reclamation returns pages to the buddy allocator during image saving.

1122) Use-after-free (CVE-ID: CVE-2026-74482)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in __folio_split() in mm/huge_memory.c when handling a split of a shmem transparent huge page during memory failure processing and truncation. A local user can trigger the vulnerable split path to cause a denial of service.

The issue can occur when a poisoned tail beyond EOF is split while truncation and a concurrent final iput() allow the inode to be evicted and RCU-freed before i_mmap_unlock_read() is reached.

1123) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-74483)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource shutdown in binfmt_misc superblock handling when mounting binfmt_misc in a user namespace and triggering mount failure. A remote attacker can repeatedly trigger failed mounts to cause a denial of service.

Exploitation is possible by an unprivileged caller under a tight memory cgroup, which can force mount failures and leak one user namespace per attempt.

1124) Improper resource shutdown or release (CVE-ID: CVE-2026-74484)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in binfmt_misc 'F' entries when registering an entry whose interpreter points at the instance itself or uses the instance as an overlayfs lower layer. A local user can register a crafted binfmt_misc entry to cause a denial of service.

The issue can pin the binfmt_misc superblock and the user namespace, causing persistent resource consumption after the mount namespace is gone.

1125) Out-of-bounds read (CVE-ID: CVE-2026-74485)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the binfmt_misc registration parser when processing a crafted registration string with a flag character used as the field delimiter. A remote attacker can submit a specially crafted registration string to disclose sensitive information.

The issue is reachable by unprivileged users in a user namespace through binfmt_misc mounts.

1126) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-74487)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in binfmt_misc when removing an entry registered with the MISC_FMT_OPEN_FILE flag. A local user can register and remove such an entry to cause a denial of service.

The issue leaves the interpreter inode with a permanently negative write count until the inode is evicted from the inode cache, causing subsequent write attempts to fail with ETXTBSY.

1127) Use-after-free (CVE-ID: CVE-2026-74488)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to use-after-free in mwifiex_11n_dispatch_amsdu_pkt() when parsing A-MSDU TDLS frames. A remote attacker can send a specially crafted A-MSDU frame with shorter earlier subframes to disclose sensitive information.

Reaching the vulnerable path requires TDLS support in firmware and the TDLS ethertype on the subframe.

1128) Use-after-free (CVE-ID: CVE-2026-74490)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in tipc_poll() trace queue dumping when walking live socket queue members from an unlocked poll context. A local user can trigger polling while queue entries are concurrently dequeued and freed to cause a denial of service.

The issue occurs in the TIPC socket trace path during queue state dumping.

1129) Use-after-free (CVE-ID: CVE-2026-74492)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a use-after-free in mtype_add() when processing packet-side add operations during ipset table resizing. A remote user can trigger xt_SET --add-set ... --exist updates to cause a denial of service.

The issue occurs when a replacement-table entry and an old-table entry temporarily share the same comment pointer during resize and backlog replay, leading to a stale pointer dereference in strlen().

1130) Use-after-free (CVE-ID: CVE-2026-74493)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in __smc_lgr_terminate() in the SMC networking subsystem when terminating a link group while a concurrent close unregisters a connection. A local user can trigger overlapping close and link group termination operations to cause a denial of service.

The issue is caused by a race condition involving socket reference handling for a connection stored in lgr->conns_all.

1131) Memory leak (CVE-ID: CVE-2026-74494)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in smb2_handle_negotiate() and connection negotiation state handling when sending repeated SMB2 NEGOTIATE requests on one connection before SESSION_SETUP. A remote attacker can send multiple successful SMB2 NEGOTIATE requests to cause a denial of service.

The issue occurs after a dialect has already been selected and before session setup completes.

1132) Off-by-one (CVE-ID: CVE-2026-74495)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an off-by-one error in the igbvf TX DMA error cleanup logic when handling TX buffer mapping errors. A local user can trigger a DMA mapping failure after one or more successful mappings to cause a denial of service.

The issue can leak exactly one DMA mapping for the packet head when a fragment mapping fails after earlier mappings succeed.

1133) Use-after-free (CVE-ID: CVE-2026-74496)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in fou_create() and fou_from_sock() when handling concurrent socket activity after a failed FOU port creation. A local user can request local port 0 and trigger concurrent receive processing to cause a denial of service.

The issue is reachable when local port 0 is requested and the creation path fails after the object remains reachable through sk_user_data.

1134) Improper input validation (CVE-ID: CVE-2026-74497)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper input validation in snd_usb_handle_sync_urb() when processing oversized USB sync packets in implicit-feedback mode. An attacker with physical access can connect a crafted USB device that sends oversized sync packets to cause a denial of service.

1135) Out-of-bounds write (CVE-ID: CVE-2026-74498)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or corrupt kernel memory.

The vulnerability exists due to an out-of-bounds write in the ALSA USB audio endpoint DMA buffer handling in data_ep_set_params() when processing USB audio endpoints with the fill_max descriptor flag set. A local user can trigger oversized packet transfers to cause a denial of service or corrupt kernel memory.

The issue occurs because the allocated buffer size is based on the original sample-rate-derived value while transfer packets may use the larger maximum packet size.

1136) Out-of-bounds write (CVE-ID: CVE-2026-74499)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service or execute arbitrary code.

The vulnerability exists due to out-of-bounds write in snd_usbmidi_akai_output() when processing MIDI output for a USB device advertising a tiny bulk-OUT endpoint. An attacker with physical access can connect a crafted USB device and trigger a write to the created MIDI device node to cause a denial of service or execute arbitrary code.

The issue is caused by a signed-to-unsigned conversion in the fill-loop bound calculation, making the loop continue writing past the end of the URB transfer buffer.

1137) Use of Uninitialized Variable (CVE-ID: CVE-2026-74500)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to uninitialized memory in snd_rme_digiface_read_status() when handling a short vendor control-IN transfer from a USB device. A local user can trigger a short read and read the exposed data through /dev/snd/controlC* to disclose sensitive information.

The issue affects the RME Digiface status controls and can expose the full 16-byte status frame to user space.

1138) Use-after-free (CVE-ID: CVE-2026-74501)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to use-after-free in ump_to_endpoint() when handling a subsequent open of the exposed UMP device node after a malicious USB MIDI 2.0 device causes creation to fail. An attacker with physical access can connect a malicious USB MIDI 2.0 device to trigger the dangling pointer dereference and disclose sensitive information.

The issue occurs because the UMP endpoint remains registered and its device node stays exposed after the associated snd_usb_midi2_ump object has been freed.

1139) Double free (CVE-ID: CVE-2026-74502)

CWE-ID: CWE-415 - Double Free

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to double free in snd_ump_attach_legacy_rawmidi() and snd_ump_endpoint_free() when enumerating a USB MIDI 2.0 (UMP) device that causes snd_rawmidi_new() to fail. An attacker with physical access can connect a crafted USB device to trigger the double free and cause a denial of service.

The issue is reached during device enumeration and later endpoint teardown.

1140) Use-after-free (CVE-ID: CVE-2026-74505)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the usb6fire_chip_probe function in the ALSA 6fire driver when handling a device probe error path. A local user can trigger the probe sequence with a crafted or malfunctioning USB device to cause a denial of service.

The issue occurs during early error handling in the probe phase after a pending URB is not properly aborted before resources are freed.

1141) Out-of-bounds read (CVE-ID: CVE-2026-74507)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in hidp_process_data() when processing a malformed HIDP numbered report response. A remote user can send a specially crafted Bluetooth HIDP data response to cause a denial of service.

Exploitation requires a connected HIDP peer.

1142) Use of uninitialized resource (CVE-ID: CVE-2026-74508)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to use of uninitialized memory in hidp_recv_ctrl_frame() and hidp_recv_intr_frame() in the HIDP subsystem when processing crafted Bluetooth HIDP frames without a transaction header. A remote user can send a specially crafted empty or malformed frame to cause a denial of service.

The issue can terminate the HIDP session when a malformed lower-layer packet causes an extra byte to be consumed as a virtual cable unplug control value.

1143) Use-after-free (CVE-ID: CVE-2026-74509)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the Bluetooth HCI advertising command-sync paths in net/bluetooth/hci_sync.c when processing advertising termination events during extended advertising, scan response, or periodic advertising data handling. A local attacker can trigger a race condition to cause a denial of service.

The issue occurs because an adv_info pointer can be retained across an HCI command wait after the associated advertising instance is removed.

1144) Use-after-free (CVE-ID: CVE-2026-74510)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in the Bluetooth management subsystem pair command handling in net/bluetooth/mgmt.c when racing pairing completion or authentication failure callbacks with a cancel pair device request. A local user can trigger concurrent pair and cancel operations to cause a denial of service or execute arbitrary code.

The issue arises from unsafe access to shared pending pairing commands on the hdev->mgmt_pending list during command cancellation and callback processing, and the race can also lead to a second list removal.

1145) Use-after-free (CVE-ID: CVE-2026-74512)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in audit_del_rule() when deleting audit rules while concurrent readers access RCU-visible filter lists. A local user can trigger rule deletion during concurrent access to cause a denial of service.

1146) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-74514)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in KVM s390 PCI memory accounting functions when accounting and unaccounting pinned pages. A local user can trigger page pinning and unpinning operations to cause a denial of service.

The issue can be triggered when unaccounting occurs in a different process context than the one that originally pinned the pages.

1147) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-74515)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state validation in kvm_s390_pci_aif_enable() when handling repeated requests to enable adapter interrupt forwarding for the same zPCI device. A local user can issue the ioctl multiple times to cause a denial of service.

The issue can also overwrite and leak resources if the operation is invoked repeatedly for the same device.

1148) Improper access control (CVE-ID: CVE-2026-74516)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access control in x2APIC MSR interception handling in KVM SVM/AVIC when AVIC is inhibited while an L2 guest is active. A local user can run a nested guest that triggers this state to cause a denial of service.

The issue can allow an L1 guest to read much of the host APIC state, send arbitrary interrupts, and change task priority before host disruption occurs.

1149) Use-after-free (CVE-ID: CVE-2026-74518)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in allocate_file_region_entries() when handling concurrent region cache operations on a shared resv_map. A local user can trigger concurrent region_chg()/region_add()/region_del() activity on the same shared mapping to cause a denial of service.

The issue occurs in shared hugetlbfs mappings and was observed when multiple mappers accessed the same hugetlbfs inode concurrently.

1150) Double free (CVE-ID: CVE-2026-74519)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to double free in dt_remember_or_free_map() and dt_free_map() in the pinctrl devicetree code when handling a failed dev_name duplication during map initialization. A local attacker can trigger a memory allocation failure during device binding to cause a denial of service.

Exploitation was demonstrated with failslab injection while binding a pinctrl-consuming device.

1151) Incorrect Comparison (CVE-ID: CVE-2026-74521)

CWE-ID: CWE-697 - Incorrect Comparison

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass client identity checks.

The vulnerability exists due to improper comparison of fixed-size binary data in ksmbd SMB3 multichannel session binding and FSCTL_VALIDATE_NEGOTIATE_INFO handling when processing ClientGUID values. A remote user can send a crafted ClientGUID containing embedded NUL bytes to bypass client identity checks.

1152) Use-after-free (CVE-ID: CVE-2026-74522)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in __close_file_table_ids() when tearing down a file table after logical file close and reference release across sessions. A local user can trigger cross-session file reference handling to dereference a stale pointer and cause a denial of service.

Exploitation requires another session to hold a temporary reference to the same ksmbd_file obtained through ksmbd_lookup_fd_inode().

1153) Deadlock (CVE-ID: CVE-2026-74523)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a deadlock in the qede recovery path when handling a TX timeout on a qede NIC with VXLAN/GENEVE tunnel ports configured. A local attacker can trigger a TX timeout condition to cause a denial of service.

The issue can wedge the rtnetlink control plane of the whole machine while the node may still answer ping.

1154) Improper resource shutdown or release (CVE-ID: CVE-2026-74525)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in init_dma_desc_rings() when handling RX descriptor ring allocation failures. A local user can trigger RX allocation failure during device initialization to cause a denial of service.

The issue results in TX ring resources being leaked when RX ring allocation fails after TX rings were allocated earlier in the same function.

1155) Use-after-free (CVE-ID: CVE-2026-74531)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in abort_conn_sync() in net/bluetooth/hci_conn.c when handling Bluetooth connection abort operations. A local user can trigger a connection abort race to cause a denial of service.

The issue is theoretical and occurs if the connection object is freed while the hci_sync task is running.

1156) Out-of-bounds read (CVE-ID: CVE-2026-74532)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in btintel_diagnostics() when parsing diagnostics TLV data from a received Bluetooth frame. A local user can send a specially crafted frame to disclose sensitive information.

1157) Use-after-free (CVE-ID: CVE-2026-74535)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free and deadlock condition in iso_sock_timeout in the Bluetooth ISO subsystem when handling socket timeout work concurrently with connection deletion or synchronously disabling delayed work while holding the socket lock. A local user can trigger socket timeout handling and connection teardown to cause a denial of service.

The issue involves a race between timeout processing and connection deletion in Bluetooth ISO sockets.

1158) Improper resource shutdown or release (CVE-ID: CVE-2026-74536)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in iso_sock_kill() and ISO socket handling in net/bluetooth/iso.c when releasing and deleting Bluetooth ISO sockets concurrently. A local user can trigger concurrent socket release and connection deletion to cause a denial of service.

The issue results in a leaked socket reference because cleanup may be skipped and the socket destructor may never be called.

1159) Use-after-free (CVE-ID: CVE-2026-74540)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in l2cap_le_connect_rsp() in the Bluetooth L2CAP subsystem when handling a crafted LE connect response during channel processing. A remote attacker can trigger a remote disconnect race to cause a denial of service.

1160) Use-after-free (CVE-ID: CVE-2026-74541)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the Bluetooth ISO socket handling code when disconnecting an ISO connection and later releasing the socket. A local user can trigger connection teardown that leaves a stale iso_data pointer to cause a denial of service.

1161) Memory leak (CVE-ID: CVE-2026-74543)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a memory leak in udp_tunnel_nic_unregister() when handling failed device registration and netdevice unregister events. A local attacker can trigger device registration failure with queued work to cause a denial of service.

The issue occurs because a queued work item can cause the unregister path to return early, leaving a struct udp_tunnel_nic allocation permanently leaked.

1162) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-74546)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a time-of-check time-of-use race condition in the adt7470 fan speed read handler when reading cached fan data during fan speed conversion. A local user can trigger concurrent updates of the cached fan value to cause a denial of service.

The issue can lead to a divide-by-zero crash if the fan data changes to 0 between the validity check and the RPM conversion.

1163) Improper input validation (CVE-ID: CVE-2026-74547)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the adt7470 hwmon driver sysfs interface and background update thread when processing user-supplied sysfs configuration values. A local user can set 'auto_update_interval' to 0 and cause the update thread to enter a tight busy-loop and flood the I2C bus to cause a denial of service.

The issue requires access to sysfs attributes, and concurrent or prior configuration of 'num_temp_sensors' to 0 triggers the zero-delay temperature read path.

1164) Use-after-free (CVE-ID: CVE-2026-74548)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the forcedeth driver txrx_stats handling in nv_remove() when unregistering a network device. A local user can trigger device removal while code paths such as ndo_get_stats64, the NAPI/xmit data path, or nv_close()/drain still access freed memory to cause a denial of service.

The issue occurs because accesses to the per-CPU statistics structure may continue until network device unregistration completes.

1165) Out-of-bounds read (CVE-ID: CVE-2026-74549)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds read in nct6775_update_pwm() in the nct6775-core hwmon driver when iterating over pwm channels for nct6116 weight-control registers. A local user can trigger access to unsupported weight registers to cause a denial of service.

The issue affects nct6116 configurations where bits 3 or 4 of has_pwm are set, causing out-of-bounds values to be used as hardware register addresses for subsequent read and write operations.

1166) Improper resource shutdown or release (CVE-ID: CVE-2026-74550)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource shutdown in ICMP/NDISC redirect handling when peer allocation fails under memory pressure or peer tree size caps. A remote attacker can trigger packet forwarding conditions that cause un-rate-limited ICMP/NDISC Redirect messages to be sent to cause a denial of service.

The issue affects both IPv4 and IPv6 redirect paths.

1167) Memory corruption (CVE-ID: CVE-2026-74551)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to improper memory alignment in the nzxt-smart2 driver output buffer when sending output reports through the USB HID core for DMA. A local user can trigger device operations such as setting a fan speed or updating the interval to cause memory corruption.

This issue affects systems with non-coherent CPU architectures such as ARM or MIPS, where the corruption is immediate and deterministic due to cacheline sharing with adjacent variables.

1168) NULL pointer dereference (CVE-ID: CVE-2026-74552)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the lm90 hwmon driver alarm reporting logic when reading sysfs attributes before driver registration is complete. A local user can read sysfs attributes during device initialization to cause a denial of service.

The issue occurs because alarm reporting work may be scheduled before data->hwmon_dev is initialized.

1169) Out-of-bounds read (CVE-ID: CVE-2026-74553)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the nct6775_probe function in the nct6775-core hwmon driver when probing NCT6116 hardware. A local attacker can trigger driver initialization to cause a denial of service.

The issue is caused by using the size of the NCT6106 temperature register array for NCT6116 even though NCT6116 only provides three temperature source and temperature source configuration registers.

1170) Race condition (CVE-ID: CVE-2026-74555)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the libsas resume handling for hisi_sas controllers when resuming the host adapter while disks are still waking up. A local user can trigger a suspend and resume sequence to cause a denial of service.

The issue can result in I/O failures and disks being disabled during resume.

1171) Heap-based buffer overflow (CVE-ID: CVE-2026-74556)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in iscsi_tcp_hdr_dissect() in libiscsi_tcp when processing a crafted iSCSI SCSI Command Response pdu. A remote attacker can send a specially crafted response with an oversized data segment to cause a denial of service.

The issue occurs because sense or response data for ISCSI_OP_SCSI_CMD_RSP can exceed the fixed 8192-byte connection buffer while remaining within the negotiated maximum receive data segment length.

1172) Out-of-bounds read (CVE-ID: CVE-2026-74557)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in iscsi_scsi_cmd_rsp() when processing a target-supplied SCSI Response sense data segment. A remote attacker can send a crafted SCSI Response with a malformed sense length field to disclose sensitive information.

The over-read can copy up to two bytes of stale conn->data contents into the command's sense buffer, which is returned to userspace.

1173) Use-after-free (CVE-ID: CVE-2026-74563)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use-after-free in rds_tcp_laddr_check() and ipv6 address checking when processing a bind request with a scoped IPv6 interface. A local user can trigger a concurrent device removal condition and issue a bind operation to disclose sensitive information.

The issue is caused by dereferencing a stale net_device pointer after the RCU read-side lock is released.

1174) Use of uninitialized resource (CVE-ID: CVE-2026-74564)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uninitialized memory access in xt_hashlimit when processing hashlimit rule configuration with inconsistent XT_HASHLIMIT_RATE_MATCH usage for the same hashtable. A local user can create specially crafted netfilter rules to cause a denial of service.

The issue arises when different rules referring to the same hashtable use conflicting rate match semantics, and revision values less than 3 are also affected when the flag is used.

1175) Use-after-free (CVE-ID: CVE-2026-74565)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in nft_object lookup handling in nf_tables when accessing objects during net namespace event processing. A local user can trigger object lookup and destruction across tables to cause a denial of service or execute arbitrary code.

The issue arises because a global object name rhltable could expose objects being dismantled from the lookup path by another existing network namespace.

1176) Improper input validation (CVE-ID: CVE-2026-74566)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the keyring subsystem when processing crafted key descriptions. A local user can add keys with specially crafted descriptions to cause a denial of service.

The issue affects in-memory ordering used to place keys within a keyring, allowing crafted descriptions to collide into one node.

1177) Out-of-bounds read (CVE-ID: CVE-2026-74567)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in keyring_get_key_chunk() when processing crafted colliding key descriptions through add_key(2). A local user can add a crafted pair of same-type keys whose index hashes collide to disclose sensitive information.

The issue is triggered when the lookup reaches a description-level chunk after collisions through the hash, x, type, and domain_tag chunks.

1178) Out-of-bounds read (CVE-ID: CVE-2026-74569)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in ct_sip_get_header() in the nf_conntrack_sip SIP connection-tracking helper when processing NAT-rewritten SIP messages over TCP. A remote attacker can send a specially crafted SIP message with a long Contact list to cause a denial of service.

The issue is triggered by integer wraparound in size-change tracking during repeated URI rewriting, which can produce an invalid length value for a subsequent header parse.

1179) Deadlock (CVE-ID: CVE-2026-74572)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock management in btree_writepages() and check_bg_is_active() in the btrfs zoned filesystem code when writing metadata extent buffers and committing transactions. A local user can trigger metadata writeback and transaction commit activity to cause a denial of service.

The issue can occur on a zoned btrfs filesystem and may result in a deadlock between metadata writeback and transaction commit.

1180) Use-after-free (CVE-ID: CVE-2026-74574)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock and use-after-free in idxd_cdev_open() when handling file-device setup failures. A local user can trigger a failure during device open processing to cause a denial of service.

The issue occurs in error-handling paths that can release the last file-device reference while the workqueue lock is still held.

1181) Use-after-free (CVE-ID: CVE-2026-74575)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the thunderbolt xdomain delayed work handling in tb_xdp_handle_request() and update_xdomain() when queuing delayed work concurrently with xdomain disconnect and removal. A local user can trigger crafted xdomain requests or state changes during disconnect to cause a denial of service.

The issue arises because the request handler runs on the system workqueue and is no longer serialized with the remove path.

1182) Improper Initialization (CVE-ID: CVE-2026-74577)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper initialization in mpls_getroute() when handling RTM_GETROUTE requests. A local user can send a crafted netlink route request to disclose sensitive information.

The issue leaks one byte of uninitialized heap memory to user space in the RTM_NEWROUTE reply.

1183) Incorrect Bitwise Shift of Integer (CVE-ID: CVE-2026-74579)

CWE-ID: CWE-1335 - Incorrect Bitwise Shift of Integer

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause incorrect netfilter payload offload matching.

The vulnerability exists due to undefined shift behavior in nft_payload_offload_mask() in net/netfilter/nft_payload.c when building an offload match mask for a payload expression that covers only part of a header field. A local privileged user can configure a crafted nftables payload rule with a partial header field match to cause incorrect netfilter payload offload matching.

The issue occurs for partial field matches such as a partial IPv6 address match where the match length is shorter than the header field length.

1184) Improper access control (CVE-ID: CVE-2026-74580)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access memory outside the intended IOTLB-mapped region.

The vulnerability exists due to improper access control in the vhost vring metadata cache in drivers/vhost/vhost.c when reconfiguring vring addresses or vring size through vhost ioctls while a device IOTLB is attached. A local user can issue crafted vring reconfiguration ioctls after populating the metadata cache to access memory outside the intended IOTLB-mapped region.

The issue occurs because stale cached metadata mappings may continue to be used after live vring reconfiguration, causing subsequent used ring updates or descriptor fetches to use translations based on the old mapping.

1185) Use-after-free (CVE-ID: CVE-2026-74581)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in fib6_rule_lookup() and fib6_rule_suppress() in the IPv6 routing rules handler when processing suppressed IPv6 route lookups. A local user can trigger route lookups involving a suppressing rule to cause a denial of service.

The issue occurs because a stale dst entry can be returned after the released route remains referenced in the lookup result.

1186) Out-of-bounds write (CVE-ID: CVE-2026-74582)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds write.

The vulnerability exists due to an out-of-bounds write in packet_snd() and packet_sendmsg_spkt() in the Linux kernel AF_PACKET implementation when handling non-ring send paths during concurrent device reconfiguration. A local user can send crafted packets while triggering a change in hard_header_len to cause an out-of-bounds write.

The issue affects SOCK_RAW send handling, and packet_sendmsg_spkt() is affected by the same inconsistent header length usage across allocation and packet construction.

1187) Use-after-free (CVE-ID: CVE-2026-74583)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the route4 fastmap cache in the cls_route classifier when classifying packets concurrently with filter deletion or modification. A local user can trigger concurrent packet classification and filter updates to cause a denial of service.

The issue is caused by a race in which an in-flight reader can republish a stale filter pointer into the fastmap after the entry has been reset and before the deferred free completes.

1188) Use of uninitialized resource (CVE-ID: CVE-2026-74584)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of uninitialized memory in the bnxt_re shared userspace page allocation in bnxt_re_alloc_ucontext() when mapping the shared page to userspace through BNXT_RE_MMAP_SH_PAGE after IB_USER_VERBS_CMD_GET_CONTEXT. A local user can perform a single mmap() on the exposed page to disclose sensitive information.

Exploitation requires access to /dev/infiniband/uverbsX on a host with a bnxt_re device.

1189) Out-of-bounds read (CVE-ID: CVE-2026-74585)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to an out-of-bounds pointer dereference in tb_drom_parse_entry_port() in the thunderbolt DROM parser when processing a malicious or malformed Thunderbolt device DROM. An attacker with physical access can supply a crafted Thunderbolt device with an invalid dual_link_port_nr value to cause a denial of service.

The invalid pointer is stored and later dereferenced after indexing sw->ports[] beyond the configured maximum port number.

1190) Use-after-free (CVE-ID: CVE-2026-74586)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to use-after-free in SCTP ASCONF handling when processing an authenticated ASCONF chunk that adds and removes a peer transport in the same chunk. A remote user can send a specially crafted authenticated ASCONF message to cause a denial of service.

The issue occurs because a stale new_transport pointer can be used when a queued HEARTBEAT is later processed during local address replacement.

1191) Use-after-free (CVE-ID: CVE-2026-74587)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the SCTP ASCONF handling code when processing a delayed authenticated ASCONF-ACK after peer restart handling purges the ASCONF queue. A remote attacker can send a delayed authenticated ASCONF-ACK to cause a denial of service.

The issue occurs because a cached ASCONF chunk pointer can remain dangling while the association is still alive during peer restart handling.

1192) Use-after-free (CVE-ID: CVE-2026-74588)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a use-after-free in __sctp_outq_flush_rtx() and SCTP transport tracking when processing SCTP SACKs after transport removal. A remote user can send crafted SCTP control traffic to cause a denial of service.

Exploitation requires an SCTP association peer to trigger transport removal through ASCONF Delete-IP and then send a SACK that reneges on the TSN.

1193) Use-after-free (CVE-ID: CVE-2026-74589)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in tcp_bpf_send_verdict() and tcp_bpf_sendmsg_redir() when processing concurrent sendmsg() operations with a cached redirect verdict. A local user can trigger concurrent socket send operations to cause a denial of service.

The issue occurs when apply_bytes keeps the cached verdict active, allowing one thread to release the redirect socket reference while another thread still uses a stale pointer.

1194) Race condition (CVE-ID: CVE-2026-74590)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to concurrent modification handling in bpf_get_fsverity_digest() when processing a dynptr-backed fsverity digest buffer. A local user can trigger the kfunc with a concurrently modified digest_size field to cause a denial of service.

The issue arises because the dynptr abstraction ensures memory validity but not stability of its contents during concurrent access.

1195) Improper Initialization (CVE-ID: CVE-2026-74592)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass integrity measurement and appraisal of truncated files.

The vulnerability exists due to improper state management in the integrity measurement architecture truncate hook handling when truncation is requested for a regular file. A local user can truncate a file to bypass integrity measurement and appraisal of truncated files.

The issue affects files whose IMA action cache flags are not reset after content changes caused by truncation.

1196) Use-after-free (CVE-ID: CVE-2026-74594)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in kernel/sched/psi.c when destroying PSI cgroup triggers concurrently with scheduling poll work. A local user can trigger a race that leaves a poll timer pending on freed memory to cause a denial of service.

The issue occurs because a timer may be re-armed during teardown and later execute poll_timer_fn() after the associated group has been freed.

1197) Improper access control (CVE-ID: CVE-2026-74595)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass owner checks and set an encryption policy on a file.

The vulnerability exists due to improper access control in fscrypt_ioctl_set_policy() when handling ioctl requests on idmapped mounts. A local user can issue a crafted ioctl on an idmapped mount to bypass owner checks and set an encryption policy on a file.

The issue occurs because the check uses the unmapped on-disk owner rather than the mapped owner on mounts that support idmapping.

1198) Out-of-bounds write (CVE-ID: CVE-2026-74597)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory.

The vulnerability exists due to an out-of-bounds write in ip6ip6_err() and the IPv6 ICMP error reply path when processing a quoted inner IPv6 packet after cloning an outer IPv6 ICMP error skb with stale inet6_skb_parm metadata. A remote attacker can send a specially crafted IPv6 packet to corrupt memory.

Exploitation requires the outer packet to carry a Home Address Option and a malformed inner destination-options header.

1199) Out-of-bounds read (CVE-ID: CVE-2026-74598)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in rt6_route_rcv() when processing a crafted IPv6 Router Advertisement containing a malformed Route Information option. A remote attacker can send a specially crafted Router Advertisement to disclose sensitive information.

When additional options follow the malformed Route Information option, data from the next option can be incorporated into the installed route and become visible to userspace.

1200) Race condition (CVE-ID: CVE-2026-74599)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in ptdump_walk_pgd() and page table walking logic when walking page tables for an mm other than init_mm. A local user can trigger page table dumping for a non-init_mm memory context to cause a denial of service.

The issue affects cases where kernel memory ranges shared across non-kernel memory contexts are walked concurrently with kernel page table freeing.

1201) Race condition (CVE-ID: CVE-2026-74601)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in ring_buffer_swap_cpu() when swapping per-cpu ring buffers during an active write operation. A local user can trigger a buffer swap at a moment when the committing counter temporarily drops to zero to cause a denial of service.

The issue can lead to an inconsistent buffer state and trigger the RB_WARN_ON in rb_commit().

1202) Improper Initialization (CVE-ID: CVE-2026-74602)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in rb_allocate_cpu_buffer() in the ring buffer subsystem when freeing ring-buffer reader pages for sub-buffers larger than PAGE_SIZE. A local user can trigger allocation and freeing of a crafted ring buffer configuration to cause a denial of service.

The issue affects ring buffers with sub-buffers larger than PAGE_SIZE.

1203) Out-of-bounds read (CVE-ID: CVE-2026-74603)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the ptp ocp devlink board id reporting logic when processing a non-NUL-terminated EEPROM board ID field. A local user can trigger reporting of the board ID to disclose sensitive information.

The issue occurs because the EEPROM board ID is a fixed 13-byte field that is not guaranteed to contain a NUL terminator.

1204) Use-after-free (CVE-ID: CVE-2026-74604)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in thermal_add_hwmon_sysfs() when handling the error path during hwmon sysfs device registration. A local user can trigger the vulnerable error-handling condition to cause a denial of service.

1205) Use-after-free (CVE-ID: CVE-2026-74606)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in eventfs_remove_rec() in fs/tracefs/event_inode.c when recursively removing eventfs child entries. A local user can trigger recursive removal of crafted eventfs entries to cause a denial of service.

The issue occurs because iteration continues by reading the next list pointer from a child entry after that child has been removed and may already have been freed.

1206) Race condition (CVE-ID: CVE-2026-74607)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in KVM SVM SEV handling for enc_context_owner and mirror_vms when processing KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM and KVM_CAP_VM_COPY_ENC_CONTEXT_FROM operations. A local user can trigger concurrent VM move, copy, or destroy operations to cause a denial of service.

The issue involves list corruption in mirror VM tracking and incorrect kvm_put_kvm() handling during VM destruction.

1207) Use-after-free (CVE-ID: CVE-2026-74608)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in cifs_try_adding_channels() when handling channel addition failures during concurrent interface list refresh. A local user can trigger the race condition to cause a denial of service.

The issue occurs on the failure path after channel creation fails and concurrent interface list refresh removes the remaining list reference.

1208) Use-after-free (CVE-ID: CVE-2026-74609)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in tipc_node_link_down() in the TIPC subsystem when handling link-down events and bearer disable operations concurrently. A local user can trigger a race condition that frees a link object while it is still being dereferenced to cause a denial of service.

The issue can result in both a use-after-free read in tipc_link_is_establishing() and a use-after-free write via tipc_link_reset() during the establishing branch.

1209) Out-of-bounds write (CVE-ID: CVE-2026-74610)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in tls_sw_sendmsg_locked() and the plaintext sk_msg ring handling in net/tls/tls_sw.c when processing sendmsg and later splice operations on a loopback TCP socket with the "tls" ULP attached. A local user can trigger the ring to appear empty after wrapping and overwrite live entries to cause a denial of service.

The issue can lead to a kernel NULL pointer dereference when a full plaintext sk_msg ring is left unpushed.

1210) Out-of-bounds read (CVE-ID: CVE-2026-74612)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information to userspace.

The vulnerability exists due to an out-of-bounds read in veth_xdp_rcv_skb() when processing an skb after XDP fragment area adjustment. A local user can run an XDP program that shrinks the fragment area to disclose sensitive information to userspace.

The issue can expose skb metadata including fragment state and a kernel pointer, and was observed on the UDP receive path.

1211) Use-after-free (CVE-ID: CVE-2026-74613)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in virtio_transport_rx_work in net/vmw_vsock/virtio_transport.c when processing RX work during device teardown. A local user can trigger the vulnerable code path to cause a denial of service.

The issue can lead to a kernel panic during suspend or freeze operations when queued work continues after virtqueues have been deleted.

1212) Race condition (CVE-ID: CVE-2026-74614)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in virtio vsock worker handling in net/vmw_vsock/virtio_transport.c when processing virtqueue work across freeze and restore operations. A local user can trigger worker activity during suspend and restore state transitions to cause a denial of service.

The issue affects the RX, TX, and event workers when a delayed worker observes a replacement queue state while retaining a pointer to a deleted queue.

1213) Use-after-free (CVE-ID: CVE-2026-74615)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a use-after-free in the vxlan ageing timer handling in drivers/net/vxlan/vxlan_core.c when changing link ageing settings on a device that is down. A remote user can create and delete a VXLAN device in a new user and network namespace to cause a denial of service.

The affected operations are network-namespace scoped.

1214) Out-of-bounds write (CVE-ID: CVE-2026-74616)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in xdpf_clone() and the XDP-to-skb conversion path when converting crafted cloned XDP frames into sk_buffs. A local user can trigger conversion of a crafted clone that overlaps skb_shared_info tailroom to cause memory corruption.

1215) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-74618)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a warning condition in binfmt_misc when completing an fscontext mount request from a different user namespace. A local user can pass an fscontext file descriptor across a namespace boundary and repeatedly trigger the warning to cause a denial of service.

The issue can be triggered in a loop to flood kernel logs, taint the kernel, and panic systems configured with panic_on_warn.

1216) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-74619)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a user namespace mismatch in ovl_fill_super() when completing an overlayfs mount context from another user namespace. A local user can pass a crafted fscontext file descriptor between namespaces and repeatedly issue FSCONFIG_CMD_CREATE to cause a denial of service.

The issue can be triggered without special capabilities by using separate user and mount namespaces, and repeated triggering can taint the kernel, flood system logs, or panic systems configured with panic_on_warn.

1217) Improper input validation (CVE-ID: CVE-2026-74620)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in act_gact and act_police fallback control action handling when configuring traffic control actions through user-supplied netlink attributes. A local user can supply a crafted fallback control action value to cause a denial of service.

The issue can cause an unbounded sk_buff memory leak for each packet traversing the affected filter chain, including kernel-generated packets.

1218) Improper resource shutdown or release (CVE-ID: CVE-2026-74621)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the act_ct traffic control action when processing malformed fragmented IPv4 or IPv6 packets during header sanity checks. A remote attacker can send a specially crafted malformed packet to cause a denial of service.

The issue can leak one sk_buff and its associated data buffer per malformed packet, which may occur on ingress or egress paths that use the connection tracking action.

1219) Improper resource shutdown or release (CVE-ID: CVE-2026-74622)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in aq_ring_rx_deinit() in the atlantic network driver when deinitializing receive rings. A local user can trigger interface teardown while buffers have been consumed but not yet refilled to cause a denial of service.

The issue occurs because receive buffers in the gap between sw_tail and sw_head can retain live pages and DMA mappings that are not released during ring deinitialization.

1220) Improper resource shutdown or release (CVE-ID: CVE-2026-74623)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in the atlantic driver TX ring deinitialization logic when tearing down network interfaces under TX or XDP_TX load. A local user can trigger interface teardown while transmit descriptors remain stranded to cause a denial of service.

Under XDP_TX load, stranded frames can keep the page pool inflight count above zero and prevent pool shutdown, with repeated stall warnings during interface down, XDP detach, or ring resize operations.

1221) Improper locking (CVE-ID: CVE-2026-74624)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper lock handling in netfilter nf_conntrack TCP and SCTP invalid-packet logging when processing invalid packets while invalid logging is routed to nfnetlink_log and conntrack export is enabled. A remote attacker can send specially crafted packets to cause a denial of service.

The issue can deadlock when invalid-packet logging re-enters conntrack netlink glue and attempts to dump the same connection tracking entry again.

1222) Memory leak (CVE-ID: CVE-2026-74625)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in nf_ct_bridge_pre() when processing non-IPv4 and non-IPv6 Ethernet frames after a bridge nftables ct zone set rule has attached a conntrack template. A remote attacker can send specially crafted non-IP traffic to cause a denial of service.

Memory is leaked by making the existing conntrack template reference unreachable, which can exhaust slab memory.

1223) Improper resource shutdown or release (CVE-ID: CVE-2026-74626)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in ntb_netdev_rx_handler() in the ntb_netdev driver when handling received packets and allocating replacement receive buffers. A remote attacker can send packets that trigger allocation failures and exhaust the receive queue to cause a denial of service.

The issue can stall packet reception while the network interface remains up.

1224) Use-after-free (CVE-ID: CVE-2026-74628)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the x25 socket timer handlers when processing timer callbacks during socket teardown. A local user can trigger timer activity on an x25 socket being destroyed to cause a denial of service.

The issue involves a race condition in which a timer callback may rearm after the socket has passed its cancel point, leading to use of freed memory on a subsequent timer expiry.

1225) Use-after-free (CVE-ID: CVE-2026-74630)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in in6_dev_get() and inet6_dev handling when processing IPv6 device state during concurrent device teardown. A local user can trigger network operations that race with device teardown to cause a denial of service or execute arbitrary code.

The issue arises from invalid reference acquisition after the object reference count has already reached zero, and the freed object may be accessed after the RCU read-side section ends.

1226) Use-after-free (CVE-ID: CVE-2026-74631)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in smc_rx_splice when processing splice operations. A local user can trigger a refcount imbalance to cause a denial of service.

The issue can underflow page refcounts in the VM-backed RMB path.

1227) Race condition (CVE-ID: CVE-2026-74632)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in mm/huge_memory.c when handling concurrent page faults and shrinker activity for the huge zero folio. A local user can trigger concurrent memory-management activity to cause a denial of service.

Only systems without CONFIG_PERSISTENT_HUGE_ZERO_FOLIO are affected.

1228) Use-after-free (CVE-ID: CVE-2026-74634)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in ring_buffer_subbuf_order_set() and rb_advance_iter() when changing the ring buffer sub-buffer order while resizing is disabled. A local user can trigger a non-consuming reader to access freed buffer pages to cause a denial of service.

The issue affects non-consuming reader scenarios in the ring buffer.

1229) Out-of-bounds read (CVE-ID: CVE-2026-74635)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the bit_cursor() function in drivers/video/fbdev/core/bitblit.c when processing screen buffer values as glyph indexes. A local user can write an arbitrary 16-bit value to /dev/vcsa to disclose sensitive information.

The issue can also be triggered when stale screen buffer data retains high-bit characters after switching from a 512-glyph font to a 256-glyph font.

1230) Race condition (CVE-ID: CVE-2026-74636)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in trace event field handling in the Linux kernel tracing subsystem when loading modules and updating trace event fields concurrently. A local user can load modules concurrently to trigger a kernel panic and cause a denial of service.

Exploitation requires the ability to initiate module loading.

1231) Use-after-free (CVE-ID: CVE-2026-74637)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in perf/core group handling when processing a PERF_IOC_FLAG_GROUP ioctl on a detached sibling event after CPU hotplug detachment. A local user can issue a crafted ioctl on a surviving perf event file descriptor to cause a denial of service.

The issue occurs when a sibling event is detached with DETACH_GROUP and kept alive while its group_leader pointer still references a leader that is later freed.

1232) Improper input validation (CVE-ID: CVE-2026-74641)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read and write arbitrary kernel memory or cause a denial of service.

The vulnerability exists due to improper input validation in snd_us428ctls_vm_fault() and snd_usx2y_hwdep_pcm_vm_fault() when handling mmap page faults with a user-controlled page offset. A local user can supply a crafted mmap() offset to map a kernel page outside the allocated shared memory region to read and write arbitrary kernel memory or cause a denial of service.

Exploitation requires access to the hwdep node of an attached US-X2Y device, and in the us428 control path the FPGA image must be loaded through the same node first.

1233) Race condition (CVE-ID: CVE-2026-74646)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in fastrpc_internal_invoke() when handling an interrupted invoke after wait_for_completion_interruptible() returns -ERESTARTSYS. A local user can trigger an interrupted invoke to cause a denial of service.

1234) Race condition (CVE-ID: CVE-2026-74647)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in fastrpc_req_munmap_impl in the fastrpc driver when processing concurrent buffer unmap requests. A local user can trigger concurrent unmap operations to cause a denial of service.

The issue occurs when multiple threads invoke unmap concurrently for the same buffer.

1235) Out-of-bounds read (CVE-ID: CVE-2026-74648)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information or cause a denial of service.

The vulnerability exists due to out-of-bounds read in rtw_cfg80211_monitor_if_xmit_entry() when processing truncated monitor transmit frames. A local user can send a specially crafted truncated frame to disclose sensitive information or cause a denial of service.

The issue occurs after removal of the radiotap header while handling 802.11 headers and related calculated header spans.

1236) Out-of-bounds write (CVE-ID: CVE-2026-74649)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to write out of bounds or disclose sensitive information.

The vulnerability exists due to out-of-bounds write in the OnAuthClient() shared-key authentication handler when processing a malformed WLAN_EID_CHALLENGE element during shared-key authentication. A remote attacker can send a specially crafted wireless authentication frame to write out of bounds or disclose sensitive information.

The issue is reachable over the air before association.

1237) Out-of-bounds read (CVE-ID: CVE-2026-74650)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in WMM_param_handler() when processing a vendor-specific information element carrying the WMM OUI. A remote attacker can send a specially crafted association response or information element blob to disclose sensitive information.

The issue is reachable from a remote peer through association response parsing from the access point.

1238) Out-of-bounds read (CVE-ID: CVE-2026-74651)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in rtw_get_wpa_ie() when parsing vendor-specific information elements from received management frames or WPA IE data. A remote attacker can send a specially crafted management frame or crafted IE data to disclose sensitive information.

The issue can be triggered by a short trailing vendor-specific information element whose length is 0 to 5 bytes.

1239) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-74653)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a stuck RX timeout condition in 8250_of for the LPC32xx UART when handling serial port interrupts. A local user can repeatedly open the front-panel serial port to cause a denial of service.

The issue can trigger a persistent interrupt storm that livelocks the CPU and trips the soft-lockup detector on affected single-core systems.

1240) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-74654)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in serial8250_rx_dma_flush() and serial8250_release_dma() when reopening a port after it is closed during an active RX DMA transfer. A local user can close and reopen the serial port to trigger a kernel Oops and cause a denial of service.

The issue occurs because stale RX state can remain set while the RX DMA channel is unavailable.

1241) Race condition (CVE-ID: CVE-2026-74655)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the qcom-geni UART DMA transmit handling in drivers/tty/serial/qcom_geni_serial.c when flushing the transmit buffer during an ongoing TX DMA transfer. A local user can trigger a large write followed by TCOFLUSH to cause a denial of service.

A subsequent tcdrain call may hang indefinitely.

1242) Use-after-free (CVE-ID: CVE-2026-74656)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in fib_nhc_update_mtu() when walking the nexthop exception table during MTU updates. A local user can trigger concurrent updates to access a freed fib_nh_exception object and cause a denial of service.

The issue involves insufficient synchronization with PMTU exception updates, and KASAN reported a read-after-free during the vulnerable code path.

1243) Incorrect Calculation of Buffer Size (CVE-ID: CVE-2026-74657)

CWE-ID: CWE-131 - Incorrect Calculation of Buffer Size

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper calculation of buffer size in fib_nlmsg_size() in the IPv4 routing subsystem when generating route notifications for nexthops that use RTA_VIA. A local user can trigger route notification handling involving an IPv6 gateway to cause a denial of service.

The issue can reach a kernel panic if panic_on_warn is set.

1244) Race condition (CVE-ID: CVE-2026-74658)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in the robust futex handling in kernel/futex/core.c when processing robust futex exit conditions. A local user can trigger a race condition involving futex waiters to cause a denial of service.

The issue can leave waiting tasks blocked indefinitely due to a lost wakeup.

1245) Use of uninitialized resource (CVE-ID: CVE-2026-74659)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to uninitialized memory exposure in br_mrp_alloc_test_skb() when constructing MRA MRP_Test frames. A remote attacker can trigger transmission of a specially crafted protocol frame to disclose sensitive information.

Three uninitialized bytes are present in each transmitted MRA MRP_Test frame because the sub-TLV length field and alignment padding are not initialized.

1246) Use-after-free (CVE-ID: CVE-2026-74660)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ebt_nflog netfilter target when processing packets that match an ebtables nflog rule during concurrent unloading of the nfnetlink_log module. A local user can trigger packet logging through a crafted ebtables nflog rule to cause a denial of service.

Exploitation requires a race with module teardown while an ebtables nflog rule remains callable.

1247) Use-after-free (CVE-ID: CVE-2026-74661)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in mac802154_beacon_worker when processing beacon work after interface teardown. A local user can trigger beacon worker activity and interface teardown to cause a denial of service.

The issue occurs because the worker continues to use a sub-interface and embedded wpan_dev after the RCU read-side critical section has ended and the request has been freed.

1248) Race condition (CVE-ID: CVE-2026-74662)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a race condition in inet_frag_create() and the fragment queue timer handling in net/ipv4/inet_fragment.c when processing fragmented packets with a zero or negative fragment timeout. A remote attacker can send specially crafted fragmented network traffic to cause a denial of service.

The issue occurs because the timer may run before the queue is published in the fqdir rhashtable, which can leave a stale hash node after reference handling becomes unbalanced.

1249) Uncontrolled Recursion (CVE-ID: CVE-2026-74663)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in qdisc hierarchy handling in net/sched qdisc grafting logic when creating and grafting a new child qdisc below an already deep parent. A local user can create a deeply nested qdisc hierarchy to cause a denial of service.

The issue affects the create-and-graft path that is not covered by the existing loop check.

1250) Incorrect Calculation of Buffer Size (CVE-ID: CVE-2026-74664)

CWE-ID: CWE-131 - Incorrect Calculation of Buffer Size

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of reply buffer sizing in ovs_flow_cmd_new() in net/openvswitch/datapath.c when processing flow update requests with mismatched identifiers. A local user can send a specially crafted flow update request to cause a denial of service.

The issue can occur when a request using a UFID falls back to flow key lookup and the matched flow requires a larger echoed reply identifier than the preallocated reply buffer provides.

1251) Race condition (CVE-ID: CVE-2026-74666)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in packet_set_ring() and pressure clearing logic in af_packet when reconfiguring the ring while packet_poll() or packet_recvmsg() accesses receive state. A local user can reconfigure the packet socket ring and trigger packet polling or receive operations to cause a denial of service.

The issue can cause __packet_rcv_has_room() to dereference stale or NULL ring storage.

1252) Out-of-bounds read (CVE-ID: CVE-2026-74667)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the packet-socket transmit path in net/packet/af_packet.c when transmitting frames through the PACKET_QDISC_BYPASS path. A local user can send a specially crafted packet through a packet socket to cause a denial of service.

The issue occurs when a driver reads eth_hdr(skb) on transmit with an unset MAC header.

1253) Race condition (CVE-ID: CVE-2026-74668)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an inconsistent use of hard_header_len in the tpacket_snd() transmit ring send path in net/packet/af_packet.c when processing tx ring frames during packet transmission. A local user can trigger concurrent netdevice reconfiguration and send crafted ring frames to cause a denial of service.

The issue can make the reserved headroom smaller than the amount later pushed, or make the computed copy length negative.

1254) Stack-based buffer overflow (CVE-ID: CVE-2026-74669)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a stack out-of-bounds write in ip_vs_in_icmp() when rebasing tunnel ICMP errors and processing IPv4 options. A remote attacker can send a specially crafted ICMP packet with IPv4 timestamp options to cause a denial of service.

The issue is triggered because stale IPv4 option metadata from the outer header is retained after the packet is rebased to the quoted original request.

1255) Out-of-bounds write (CVE-ID: CVE-2026-74670)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the IPVS estimator logic in net/netfilter/ipvs/ip_vs_est.c when processing temporary estimators during network namespace teardown after IPVS is disabled. A local user can trigger estimator enqueue operations in this state to cause a denial of service.

The issue occurs when the initial calculation phase exits without installing positive chain and tick limits, allowing the estimator thread to continue with zero limit values.

1256) Out-of-bounds read (CVE-ID: CVE-2026-74671)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in xattr_verify() when verifying a truncated security.ima extended attribute value. A local user can provide a specially crafted truncated extended attribute to disclose sensitive information.

The issue is triggered by an integer underflow caused by mixing signed and unsigned arithmetic in the digest-length check.

1257) Use-after-free (CVE-ID: CVE-2026-74672)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a use-after-free in kernel page table walking and vmap huge page table promotion logic when page tables are freed concurrently with debugging page table walks. A local user can trigger concurrent page table operations to cause a denial of service or execute arbitrary code.

The issue occurs because ptdump walks kernel page table ranges it does not own while huge vmap promotion can free lower page tables during the walk.

1258) Use of Uninitialized Variable (CVE-ID: CVE-2026-74673)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an uninitialized stack-based structure in evdev event handling functions when copying input_event structures to userspace. A local user can read crafted event data from the evdev client buffer to disclose sensitive information.

The issue affects padding bytes in struct input_event on architectures where explicit or implicit padding is present.

1259) Race condition (CVE-ID: CVE-2026-74675)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in kbd_keycode in drivers/tty/vt/keyboard.c when handling keyboard input while accessing vc->port.tty. A local user can trigger the race to cause a denial of service.

1260) Improper access control (CVE-ID: CVE-2026-74676)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to modify keyboard meta mode on a non-controlling console without authorization.

The vulnerability exists due to improper access control in the KDSKBMETA ioctl handler in vt_k_ioctl() when processing KDSKBMETA ioctl requests. A local user can invoke the KDSKBMETA ioctl to modify keyboard meta mode on a non-controlling console without authorization.

1261) Use-after-free (CVE-ID: CVE-2026-74677)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ipheth carrier_work logic in drivers/net/usb/ipheth.c when handling USB disconnect and TX URB completion events. A local user can trigger link down and unplug conditions while a TX URB is in flight to cause a denial of service.

Exploitation requires an attached USB device that stops draining bulk OUT, and the described reproducer was driven as root.

1262) Improper resource shutdown or release (CVE-ID: CVE-2026-74678)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in ax88179_tx_fixup() when processing transmitted socket buffers with NETIF_F_SG enabled and skb_linearize() fails. A local user can trigger transmission of packets under memory pressure to cause a denial of service.

The issue occurs because the socket buffer is not freed when the function returns NULL on the linearization failure path.

1263) Out-of-bounds read (CVE-ID: CVE-2026-74679)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the usb gadget ncm function when processing a crafted ncm network transfer block from a malicious host. A remote attacker can supply a large offset that becomes negative after signed integer overflow to disclose sensitive information.

1264) Improper resource shutdown or release (CVE-ID: CVE-2026-74680)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in cxacru_cm() in the cxacru usb atm driver when handling error conditions during urb submission and command processing. A local user can trigger an error path that leaves rcv_urb active to cause a denial of service.

The issue can be reached during device initialization when a subsequent status poll invokes the same command path again, leading to a warning when the active urb is resubmitted.

1265) Out-of-bounds write (CVE-ID: CVE-2026-74682)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in the ALSA usb-audio endpoint handling code when processing inbound URBs for Type II capture formats after userspace sets hw_params on the stream. A local user can use a device advertising a Type II capture format to trigger an out-of-bounds write and cause memory corruption.

Only capture streams are affected.

1266) Out-of-bounds read (CVE-ID: CVE-2026-74683)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in evdev_get_mask_cnt() when handling EVIOCGMASK or EVIOCSMASK ioctl requests with a user-supplied event type index. A local user can supply a crafted event type index to disclose sensitive information.

The issue arises from speculative execution mispredicting bounds checks during access to the static counts array and can affect subsequent mask handling logic.

1267) NULL pointer dereference (CVE-ID: CVE-2026-74684)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in tap_get_user_xdp() when parsing a virtio-net header from an XDP buffer before assigning skb->dev. A local user can provide a crafted XDP buffer with a GSO virtio-net header and a zero protocol value to cause a denial of service.

The issue is triggered on the vhost TX path.

1268) Use-after-free (CVE-ID: CVE-2026-74688)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the SCTP control chunk handling logic when transmitting a queued HEARTBEAT ACK after the associated peer transport has been removed. A remote attacker can trigger peer transport removal while a control chunk retains a stale transport pointer to cause a denial of service.

The issue occurs when src_out_of_asoc_ok is enabled and the HEARTBEAT ACK remains queued on control_chunk_list instead of being transmitted immediately.

1269) Out-of-bounds read (CVE-ID: CVE-2026-74689)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in vcc_setsockopt() when processing crafted setsockopt calls. A local user can supply a mismatched level or a shortened optlen value to trigger an out-of-bounds read and disclose sensitive information.

The issue can also be triggered if a cgroup BPF setsockopt filter shrinks optlen after entry.

1270) Incorrect behavior order (CVE-ID: CVE-2026-74691)

CWE-ID: CWE-696 - Incorrect Behavior Order

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper shutdown sequence in the thunderbolt networking teardown logic when disabling thunderbolt DMA paths during interface teardown. A local user can trigger interface teardowns to cause a denial of service.

On affected systems, repeated teardowns can eventually take the XDomain control channel down, after which the peer node disappears until the controller is power cycled.

1271) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-74692)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a time-of-check time-of-use race condition in smc_listen_out() in net/smc/af_smc.c when handling TCP connection attempts while a listener is being closed. A remote attacker can open TCP connections during the race window to cause a denial of service.

The issue can leak child smc_sock objects, their clcsock objects, and references, which can exhaust kernel memory.

1272) Out-of-bounds read (CVE-ID: CVE-2026-74693)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in prestera_fw_hdr_parse() when parsing a crafted firmware image. A local user can provide a specially crafted firmware image to cause a denial of service.

1273) Out-of-bounds read (CVE-ID: CVE-2026-74694)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ncsi_send_cmd_nl() and ncsi_cmd_handler_oem() when processing a netlink request containing an NCSI packet header with a forged payload length. A local user can send a specially crafted netlink request to disclose sensitive information.

Exploitation requires a registered NCSI device.

1274) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-74696)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state management in TCP Fast Open listener queue accounting when migrating pending Fast Open children across SO_REUSEPORT listeners. A remote attacker can establish multiple pending Fast Open requests during listener migration to cause a denial of service.

This only occurs with SO_REUSEPORT listener migration involving still-pending TCP Fast Open children.

1275) Exposure of Resource to Wrong Sphere (CVE-ID: CVE-2026-74697)

CWE-ID: CWE-668 - Exposure of resource to wrong sphere

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt data.

The vulnerability exists due to improper hardware interaction in the bnxt_en AGG ring handling in the bnxt driver when processing TPA data with EOP and relaxed ordering enabled. A local user can trigger network traffic processing that causes overlapping zero padding to corrupt data.

The issue was reported on some ARM systems using 57508 (P5) chips, and it occurs when TPA is enabled.

1276) Race condition (CVE-ID: CVE-2026-74700)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to a race condition in net/sched/cls_api.c when handling concurrent classifier creation requests in the same chain and priority. A local user can trigger concurrent u32 and flower filter operations to cause a use-after-free.

Exploitation requires concurrent requests that race during tc_new_tfilter processing.

1277) Out-of-bounds read (CVE-ID: CVE-2026-74701)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in key_extract() in the Open vSwitch flow extraction logic when processing a packet on an ARPHRD_NONE device with a user-controlled protocol field indicating Ethernet. A local user can send a specially crafted packet with an insufficient linear header to cause a denial of service.

The issue is triggered when the packet is received from devices such as TUN.

1278) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-74704)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of malformed packets in sch_cake ACK filter when parsing malformed IP headers. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue may result in warning log flooding, or a kernel panic when panic_on_warn is enabled.

1279) Use-after-free (CVE-ID: CVE-2026-74705)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in __skb_udp_tunnel_segment() in net/ipv4/udp_offload.c when processing tunnel segmentation for skb data after pulling the tunnel header into the skb head. A local attacker can trigger skb head reallocation and subsequent use of a stale UDP header pointer to cause a denial of service.

1280) Out-of-bounds read (CVE-ID: CVE-2026-74710)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in AF_XDP TX metadata handling in xdp_umem_reg() when processing a registered TX metadata length smaller than 16 bytes. A local user can register a crafted TX metadata length to disclose sensitive information.

1281) Use-after-free (CVE-ID: CVE-2026-74714)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in bpf_iter_tcp_established_batch() when iterating over established TCP sockets. A local user can trigger concurrent socket activity and read an iter/tcp link to cause a denial of service.

This issue can occur when request_sock objects are visible in the ehash chain before their reference count is initialized, leading to a stale reachable socket being freed prematurely.

1282) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-74717)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of error conditions in the mlx5 firmware tracer core dump logic when processing a tracer creation failure. A local user can trigger the vulnerable code path to cause a denial of service.

The issue can lead to an ERR_PTR dereference and kernel panic during core dump handling.

1283) Improper resource shutdown or release (CVE-ID: CVE-2026-74718)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in devlink_nl_reload_doit() when handling a devlink reload request that targets a different network namespace with an action other than DRIVER_REINIT. A local user can send a specially crafted devlink reload request to cause a denial of service.

1284) Memory leak (CVE-ID: CVE-2026-74719)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in smc_llc_event_handler() when handling duplicate CONFIRM_LINK or ADD_LINK_CONT messages while a local LLC flow is active and a qentry is already pending. A remote attacker can send duplicate crafted messages to cause a denial of service.

The issue affects the SMC_LLC_CONFIRM_LINK and SMC_LLC_ADD_LINK_CONT handling path, while the response direction is not affected.

1285) Improper Initialization (CVE-ID: CVE-2026-74720)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in adjust_ptr_min_max_vals() in the BPF verifier when handling commuted arithmetic involving scalar += pointer operations. A local user can execute a crafted BPF program to cause a denial of service.

The issue occurs because the destination register did not preserve the complete pointer register state, which could leave frame number and parent identity tracking inconsistent for pointer provenance.

1286) Improper resource shutdown or release (CVE-ID: CVE-2026-74722)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in btrfs_do_encoded_write() when handling crafted Btrfs encoded write ioctl requests. A local user can invoke the encoded write ioctl to cause a denial of service.

1287) Out-of-bounds write (CVE-ID: CVE-2026-74724)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in ip_vs_nat_icmp when processing ICMP packets with a modified embedded IPv4 header length field. A local attacker can modify a packet while it is processed by IPVS to cause memory corruption.

1288) Race condition (CVE-ID: CVE-2026-74726)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in bond_alb_monitor in the bonding ALB implementation when handling active slave changes under RTNL. A local user can trigger network interface state changes to cause a denial of service.

The issue can lead to a null pointer dereference and kernel panic, and in failover cases can underflow the new slave's promiscuity counter and leave it stuck in promiscuous mode.

1289) Use-after-free (CVE-ID: CVE-2026-74730)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the NFS FREE_STATEID handling in fs/nfs/nfs4proc.c when processing a delayed FREE_STATEID operation. A local user can trigger a delayed FREE_STATEID operation to cause a denial of service.

1290) Improper update of reference count (CVE-ID: CVE-2026-74735)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference counting in the l2tp seq_file handlers for /proc/net/pppol2tp and /sys/kernel/debug/l2tp/tunnels when closing the file before reading to end-of-file. A local user can close the file early to cause a denial of service.

The issue occurs because tunnel and session references kept in seq_file private iteration state are not dropped on release.

1291) Improper access control (CVE-ID: CVE-2026-74736)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access control in cls_bpf_prog_from_efd() in net/sched/cls_bpf.c when attaching a device-bound bpf classifier program to a network device via cls_bpf with skip_sw. A local user can attach a program bound to a different device and then delete the original device to cause a denial of service.

The issue can trigger a kernel warning and may panic the system when panic_on_warn=1.

1292) Out-of-bounds read (CVE-ID: CVE-2026-74737)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds memory access in the am65-cpsw-nuss packet reception path when processing RX DMA descriptor metadata containing the source tag. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue occurs because the driver uses the full 16-bit source tag as the port identifier even though only the lower 8 bits represent the MAC port ID, while the upper 8 bits are hardware-reserved and may contain arbitrary values.

1293) Out-of-bounds read (CVE-ID: CVE-2026-74739)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in u32_bind_class() when processing cls_u32 walker callback entries. A local user can trigger class binding on a hash table entry that is incorrectly treated as a tc_u_knode to disclose sensitive information.

The issue occurs because u32_walk() can enumerate both tc_u_hnode and tc_u_knode objects, but the affected code unconditionally treats the callback argument as a tc_u_knode.

1294) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-74740)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a time-of-check time-of-use race condition leading to a NULL pointer dereference in tcf_action_exec() and tcf_action_goto_chain_exec() in net/sched/act_api.c when handling TC_ACT_GOTO_CHAIN actions. A local user can trigger concurrent action updates and execution to cause a denial of service.

The issue occurs when a->goto_chain is cleared between separate RCU reads, causing a NULL chain pointer to be dereferenced through chain->filter_chain.

1295) Use-after-free (CVE-ID: CVE-2026-74743)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a use-after-free in the macvlan network device handling in drivers/net/macvlan.c when processing packets on a macvlan device backed by a lower device that requires additional headroom or tailroom. A remote attacker can send network traffic that triggers insufficient buffer space handling to execute arbitrary code.

The issue can be triggered when the lower device requires extra header or trailer space, such as with macsec, ipsec, wireguard, tunnels, or veth with rx headroom.

1296) Use-after-free (CVE-ID: CVE-2026-74744)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a use-after-free in the ipvlan network device component when handling packet header and tailroom requirements inherited from the underlying physical device. A remote attacker can trigger packet processing that causes insufficient headroom or tailroom reservation to execute arbitrary code.

The issue can occur when the underlying physical or stacked lower device requires extra headroom or tailroom for headers or trailers.

1297) Use-after-free (CVE-ID: CVE-2026-74746)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a use-after-free in the netfilter flowtable subsystem when inserting flow tuple nodes into the rhashtable. A remote attacker can trigger garbage collection to observe a partially installed flow to execute arbitrary code.

KASAN reported read and write access to freed slab memory in the flowtable and rhashtable path.

1298) Race condition (CVE-ID: CVE-2026-74748)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in __ip_set_put_byindex() in the netfilter ipset subsystem when list:set garbage collection and set swap operations occur concurrently. A local user can trigger concurrent ipset operations to cause a denial of service.

The issue can lead to a kernel BUG and panic from timer softirq context.

1299) Use-after-free (CVE-ID: CVE-2026-80521)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code or cause a denial of service.

The vulnerability exists due to a use-after-free in unix_del_edge() and the af_unix garbage collector when processing concurrent socket edge updates and garbage collection. A local user can trigger concurrent send() and close() operations on crafted unix socket reference cycles to execute arbitrary code or cause a denial of service.

The issue occurs in a race window where a new edge becomes visible to garbage collection before its skb is queued, allowing a dead strongly connected component to be partially freed while stale scc_entry state remains reachable during a later GC walk.

1300) Out-of-bounds read (CVE-ID: CVE-2026-80526)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to an out-of-bounds read in tas2562_volume_control_put() when processing userspace volume control values. A local user can supply a specially crafted control value to execute arbitrary code.

The out-of-bounds array access uses a user-controlled index derived from the volume value and may result in an unintended value being written to the device.

1301) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-80527)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state management in __ceph_get_caps() when handling Ceph capability revocation and reacquisition. A remote attacker can trigger conflicting operations that leave stale mds_wanted state and cause a reader to wait indefinitely to cause a denial of service.

The issue occurs when a cap update requesting FILE_RD does not reach the MDS after mds_wanted has been raised, leaving the client without the wanted file read capability while local state still indicates it is wanted.

1302) Improper resource shutdown or release (CVE-ID: CVE-2026-80528)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a kernel crash.

The vulnerability exists due to improper resource shutdown or release in handle_reply() in fs/ceph/mds_client.c when processing Ceph MDS replies and filling inode and dentry cache data. A remote attacker can send a specially crafted Ceph MDS reply to cause a kernel crash.

The issue occurs because Ceph-private data stored in current->journal_info may be dereferenced by another filesystem during reclaim.

1303) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-80529)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause filesystem corruption.

The vulnerability exists due to improper handling of error conditions in xlog_recover_dquot_commit_pass2() when recovering quota log items. A local user can trigger quota recovery involving a corrupted dquot to cause filesystem corruption.

The issue occurs because a recovered dquot verification failure is discarded, allowing log recovery to proceed as if the dquot were valid and enabling a corrupt quota buffer to be written back to disk.

1304) Improper locking (CVE-ID: CVE-2026-80534)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock release in xfs_dq_get_next_id when handling an error from xfs_iread_extents. A local user can trigger the error condition during quota operations to cause a denial of service.

The issue can leave the quota inode locked, causing subsequent quota operations to hang.

1305) Out-of-bounds write (CVE-ID: CVE-2026-80536)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in xlog_recover_do_reg_buffer() when processing a crafted XFS filesystem image during mount-time log recovery. A remote attacker can mount a specially crafted filesystem image to execute arbitrary code.

The issue is reachable during mount-time recovery on production kernels where the bounds check was enforced only by an ASSERT().

1306) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-80539)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in amdgpu_cs_pass1() and amdgpu_cs_p1_user_fence() when processing a submit request containing multiple AMDGPU_CHUNK_ID_FENCE chunks. A local user can submit crafted command stream data with duplicate fence chunks to cause a denial of service.

The leaked buffer object reference can outlive handle close and process exit.

1307) Integer overflow (CVE-ID: CVE-2026-80540)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to an integer overflow in the amdgpu UVD decode message handler when processing crafted decode parameters. A local user can supply a crafted pitch value to trigger the overflow and execute arbitrary code.

The issue is in the Linux kernel DRM AMDGPU UVD decode path.

1308) Improper input validation (CVE-ID: CVE-2026-80541)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in amdgpu_gem_create_ioctl() when processing GEM create requests with invalid domain combinations. A local user can submit a specially crafted domain combination to cause a denial of service.

The issue is triggered when CPU, GTT, or VRAM domains are combined with DOORBELL, GDS, GWS, or OA domains, causing amdgpu_bo_placement_from_domain() to exceed AMDGPU_BO_MAX_PLACEMENTS and hit BUG_ON().

1309) Race condition (CVE-ID: CVE-2026-80547)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information, modify data, or cause a denial of service.

The vulnerability exists due to a race condition in the vfio_ccw crw handling logic when processing asynchronous hardware events and userspace reads of the crw region. A local user can trigger concurrent access to the crw list to disclose sensitive information, modify data, or cause a denial of service.

The issue affects the s390 vfio_ccw subsystem and involves the crw queue being accessed from asynchronous hardware-driven paths.

1310) Race condition (CVE-ID: CVE-2026-80548)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges and compromise confidentiality, integrity, and availability.

The vulnerability exists due to a race condition in the vfio_ccw I/O resource handling and channel program lifecycle management when processing concurrent I/O operations and state transitions. A local user can trigger concurrent operations to escalate privileges and compromise confidentiality, integrity, and availability.

The issue affects the s390 vfio_ccw driver.

1311) Improper locking (CVE-ID: CVE-2026-80549)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper locking in the vfio_ccw driver when handling a device transitioning to a not-operational state. A local privileged user can trigger this condition to cause a denial of service.

The cleanup may occur asynchronously while other locks are held in the calling sequence.

1312) Out-of-bounds read (CVE-ID: CVE-2026-80550)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ccwchain_calc_length() when processing chained channel command words in a channel program. A remote attacker can supply a crafted channel program to disclose sensitive information.

The issue occurs because the routine may examine a 257th CCW entry before rejecting an oversized chain.

1313) Improper input validation (CVE-ID: CVE-2026-80551)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code or cause a denial of service.

The vulnerability exists due to improper input validation in the vfio_ccw channel program IDAW handling when reading the first IDAW and then processing the full IDAL. A remote attacker can trigger inconsistent IDAW reads to execute arbitrary code or cause a denial of service.

The issue affects the s390 vfio_ccw subsystem and arises because the first IDAW is read separately from the full IDAL.

1314) Out-of-bounds write (CVE-ID: CVE-2026-80552)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information, modify memory, or cause a denial of service.

The vulnerability exists due to an out-of-bounds access in vfio_ccw region read and write handlers when processing read or write requests for vfio_ccw regions with an out-of-range region index. A local user can supply a crafted region index to disclose sensitive information, modify memory, or cause a denial of service.

The issue affects vfio_ccw read and write region handling on s390.

1315) Use-after-free (CVE-ID: CVE-2026-80553)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in the vfio_ccw device workqueue handling when closing or releasing a device with pending work items. A local user can trigger device close or release while queued work is still pending to execute arbitrary code.

1316) Uncontrolled Recursion (CVE-ID: CVE-2026-80554)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to uncontrolled recursion in vfio_ccw channel program processing when handling channel programs with many TIC-linked segments. A remote attacker can supply a crafted channel program to execute arbitrary code.

The issue arises because channel programs are processed recursively and segment counts created by Transfer-In-Channel (TIC) CCWs were not equivalently limited.

1317) Improper resource shutdown or release (CVE-ID: CVE-2026-80555)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the vfio_ccw channel program initialization logic when processing channel programs containing Transfer in Channel segments. A remote attacker can trigger cp_init() failure during ccwchain construction to cause a denial of service.

The issue occurs because cleanup does not release all allocated CCW segments if initialization fails before the channel program is marked initialized.

1318) Use-after-free (CVE-ID: CVE-2026-80556)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in the atmci_remove function in the atmel-mci driver when removing the module while queued or running bh_work is still pending. A local user can trigger a race condition during module removal to execute arbitrary code.

The issue arises because the interrupt handler, timeout timer, or DMA completion callback can schedule the work item before cleanup completes.

1319) Out-of-bounds read (CVE-ID: CVE-2026-80557)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information, execute arbitrary code, or cause a denial of service.

The vulnerability exists due to an out-of-bounds read in decode_watchers() when processing a crafted obj_list_watch_response_t reply with struct_len set to 0. A remote attacker can send a specially crafted OSD response to disclose sensitive information, execute arbitrary code, or cause a denial of service.

Exploitation requires a malicious or compromised OSD and can be triggered when a kernel client invokes CEPH_OSD_OP_LIST_WATCHERS.

1320) Out-of-bounds read (CVE-ID: CVE-2026-80558)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information, corrupt memory, or cause a denial of service.

The vulnerability exists due to out-of-bounds read in ceph_pg_to_up_acting_osds() and calc_target() when processing a corrupted osdmap containing an invalid primary_temp OSD index. A remote attacker can send a crafted osdmap with a nonexistent OSD index to trigger out-of-bounds array access to disclose sensitive information, corrupt memory, or cause a denial of service.

The issue occurs because the primary_temp OSD index was not properly validated before being used as the target OSD for a request.

1321) Race condition (CVE-ID: CVE-2026-80559)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a system crash.

The vulnerability exists due to a race condition in the sur40 input device initialization and polling path when opening the input device before the V4L2 video device and vb2_queue are fully initialized. A local user can open the device to trigger the polling worker thread and cause a system crash.

The issue is triggered during device initialization ordering in sur40_probe().

1322) Improper privilege management (CVE-ID: CVE-2026-80560)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to improper access control in restore_sigcontext() in the openrisc signal handling code when returning from a signal handler through a crafted sigframe. A local user can craft a sigframe that modifies privileged SR bits to escalate privileges.

By clearing SPR_SR_DME, data accesses can occur without MMU translation or protection, enabling read and write access to arbitrary physical memory.

1323) Out-of-bounds read (CVE-ID: CVE-2026-80561)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information and cause a denial of service.

The vulnerability exists due to out-of-bounds read in decode_locker() in net/ceph/cls_lock_client.c when decoding locker data from an OSD response. A remote attacker can send a specially crafted OSD response to disclose sensitive information and cause a denial of service.

Exploitation requires a malicious or compromised OSD to interact with a kernel client issuing the lock.get_info class method, such as during RBD exclusive lock acquisition.

1324) Improper locking (CVE-ID: CVE-2026-80562)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock type selection in the gpio-ml-ioh driver irq callbacks when invoking irq_set_type, irq_enable, or irq_disable while the IRQ descriptor lock is held in a non-sleepable context. A local user can trigger these callbacks to cause a denial of service.

The issue is specific to PREEMPT_RT kernels.

1325) Improper resource shutdown or release (CVE-ID: CVE-2026-80565)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to improper resource shutdown or release in the qce algorithm registration logic in drivers/crypto/qce/core.c when handling a failure during algorithm registration. A local user can trigger a registration failure to execute arbitrary code.

1326) Out-of-bounds read (CVE-ID: CVE-2026-80566)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the hynitron_cstxxx touchscreen driver when parsing touch controller reports. A local user can provide crafted touch data with an invalid touch count or finger ID to cause a denial of service.

The issue can corrupt the touch state of a previously active slot, and on the V821 Avaota F1 board a finger ID of 1 is already invalid because the driver is configured with a single touch slot.

1327) Unchecked Return Value (CVE-ID: CVE-2026-80567)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper handling of worker errors in rmi_f54_buffer_queue() in the synaptics-rmi4 F54 driver when processing queued V4L2 buffers. A local user can trigger a worker failure to disclose sensitive information.

Stale or uninitialized memory may be delivered to userspace if report acquisition fails.

1328) Heap-based buffer overflow (CVE-ID: CVE-2026-80568)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in the synaptics-rmi4 F54 V4L2 input handling when changing the diagnostic report input while streaming. A local user can switch the input mid-stream to trigger a larger report size than the allocated buffers and execute arbitrary code.

The issue occurs because V4L2 buffers are allocated based on the report size at stream start.

1329) Out-of-bounds write (CVE-ID: CVE-2026-80569)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in the synaptics-rmi4 F54 diagnostics report handling in rmi_f54_work() when processing a malicious or malfunctioning RMI4 device report with larger F55 electrode counts than F54 counts. A local user can provide a specially crafted device that reports inconsistent electrode counts to execute arbitrary code.

The issue can also cause an out-of-bounds read during the subsequent V4L2 dequeue memcpy().

1330) Heap-based buffer overflow (CVE-ID: CVE-2026-80570)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code or cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in rmi_f54_buffer_queue() when handling a failed report operation after the V4L2 format has been changed to a smaller size. A local user can trigger an error path that leaves a stale larger report size and cause it to be copied into a smaller buffer to execute arbitrary code or cause a denial of service.

The issue is caused by failure to clear f54->report_size on certain error paths in rmi_f54_work().

1331) Use-after-free (CVE-ID: CVE-2026-80572)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in the byd driver timer callback handling in drivers/input/mouse/byd.c when disconnecting the device while timer callbacks are running or being re-armed. A local user can trigger a race condition to execute arbitrary code.

The issue arises because the callback can dereference freed private data and its psmouse pointer during driver disconnect.

1332) Out-of-bounds read (CVE-ID: CVE-2026-80573)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in the iforce input packet processing logic when parsing crafted USB input packets. A local attacker can send crafted short packets to trigger out-of-bounds reads and cause a denial of service.

Exploitation requires delivery of malformed data through a connected USB device.

1333) Out-of-bounds write (CVE-ID: CVE-2026-80574)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in focaltech_process_rel_packet when processing crafted input packets. A remote attacker can trigger a finger index underflow to write before the bounds-checked array and to execute arbitrary code.

The issue occurs because subtracting 1 from a packet finger index of 0 can produce an invalid array index that targets state->fingers[-1].

1334) Out-of-bounds write (CVE-ID: CVE-2026-80576)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt memory and cause a denial of service.

The vulnerability exists due to an out-of-bounds write in amdgpu_cs_p2_ib() when processing user-supplied indirect buffer lengths for command submission. A local user can submit an oversized indirect buffer to corrupt memory and cause a denial of service.

The issue affects GFX rings and can destabilize command submission because the indirect buffer length is encoded into packet control fields.

1335) Out-of-bounds read (CVE-ID: CVE-2026-80578)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information and cause a denial of service.

The vulnerability exists due to out-of-bounds read in fb_io_read() when processing a read operation after a partial copy_to_user() result. A local user can provide a faulty user buffer to trigger pointer desynchronization and disclose sensitive information and cause a denial of service.

The issue occurs because the source pointer can become over-advanced relative to the remaining byte count after a partial copy.

1336) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-80581)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of IPC timeout conditions in sof_ipc4_trigger_pipelines in sound/soc/sof/ipc4-pcm.c when processing pipeline trigger state changes. A local user can trigger pipeline state transitions that encounter an IPC timeout to cause a denial of service.

The issue occurs when reply handling is blocked by system scheduling blockage, which can leave internal pipeline state handling inconsistent until the DSP is booted again.

1337) Out-of-bounds write (CVE-ID: CVE-2026-80583)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information, modify memory, or cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the tx_macro_dec_mode_get() and tx_macro_dec_mode_put() kcontrol handlers in sound/soc/codecs/lpass-tx-macro.c when accessing enumerated control values. A local user can access a crafted enumerated control value through the "DEC0 MODE" to "DEC7 MODE" controls to disclose sensitive information, modify memory, or cause a denial of service.

On 64-bit kernels built with CONFIG_SND_CTL_DEBUG, the issue is detected as an access overflow and reads of these controls fail with -EINVAL.

1338) Out-of-bounds write (CVE-ID: CVE-2026-80584)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in the qeth SNMP and ARP query ioctl handlers when processing user-supplied buffer lengths. A remote attacker can supply a crafted length value that causes an integer underflow in a bounds check and trigger a memcpy() past the allocated buffer to execute arbitrary code.

The issue occurs because a user-supplied length smaller than the fixed offset can wrap a u32 subtraction, and a zero-length allocation can also result in an invalid zero-sized buffer.

1339) Improper Initialization (CVE-ID: CVE-2026-80585)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and corrupt integrity.

The vulnerability exists due to improper state management in mptcp_fastopen_subflow_synack_set_params() and check_fully_established() when processing data-less TCP Fast Open SYN packets with a valid cookie. A remote attacker can send a specially crafted SYN packet to cause a denial of service and corrupt integrity.

The issue occurs when a valid-cookie SYN carries no data, leaving the receive queue empty and stale MPTFO state behind.

1340) Missing initialization of resource (CVE-ID: CVE-2026-80586)

CWE-ID: CWE-909 - Missing initialization of resource

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information, corrupt data, or cause a denial of service.

The vulnerability exists due to improper state reset in MPTCP DSS option parsing in net/mptcp/options.c when processing malformed DSS options with an unexpected size. A remote attacker can send crafted MPTCP packets to disclose sensitive information, corrupt data, or cause a denial of service.

The issue can occur when a malformed DSS option is followed by another DSS option or MPC plus data, causing inconsistent state or access to uninitialized data.

1341) Improper input validation (CVE-ID: CVE-2026-80587)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper input validation in the MPTCP option parser when processing incoming MPTCP suboptions. A remote attacker can send specially crafted packets with inconsistent suboption combinations to execute arbitrary code.

The issue affects handling of mutually exclusive or unexpected combinations of MPTCP suboptions.

1342) Use-after-free (CVE-ID: CVE-2026-80589)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a use-after-free in disk_release in the block layer when handling a probe failure for a disk that issued I/O before add_disk(). A remote attacker can trigger a failed disk initialization sequence that leaves a queue timeout timer pending to execute arbitrary code.

The issue can occur when a disk probe fails before the disk is added, including cases involving NVMe namespace initialization.

1343) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-80590)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of gso metadata in inet fragment reassembly when processing crafted IP fragments with attached GSO state. A local user can write specially crafted packets to a tap device to cause a denial of service.

The issue can be triggered by an unprivileged user in its own user namespace, and it may also be reachable in environments where virtio_net_hdr metadata is forwarded to a tap device or where CAP_NET_RAW is available in a network namespace.

1344) Out-of-bounds read (CVE-ID: CVE-2026-80591)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in f2fs_listxattr() when processing corrupted xattr entries. A local user can supply a crafted corrupted filesystem image to cause a denial of service.

The issue occurs when an xattr entry lies outside the valid xattr storage area.

1345) Out-of-bounds read (CVE-ID: CVE-2026-80593)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the atk_ec_present() function in the asus_atk0110 hwmon driver when processing a malformed firmware package returned by the GGRP ACPI method. A local attacker can provide a zero-length sub-package to trigger the out-of-bounds read and disclose sensitive information.

1346) Improper input validation (CVE-ID: CVE-2026-80594)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper input validation in ims_pcu_get_cdc_union_desc() when parsing CDC union descriptors from a malicious USB device. An attacker with physical access can provide a crafted descriptor with bLength set to 0 to cause a denial of service.

1347) Out-of-bounds read (CVE-ID: CVE-2026-80595)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in the ims-pcu driver when processing response data from device buffers. A local user can provide a short device response to disclose sensitive information.

The issue can also result in processing stale data from the buffers.

1348) NULL pointer dereference (CVE-ID: CVE-2026-80597)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the vmu-flash initialization code when initializing the mtd_info device structure without linking it to its parent device. A local user can trigger initialization of the affected component to cause a denial of service.

1349) Out-of-bounds read (CVE-ID: CVE-2026-80598)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in decompress_lznt() when parsing invalid compressed data from a corrupted NTFS3 image. A local user can supply a crafted NTFS3 image to disclose sensitive information.

1350) Out-of-bounds read (CVE-ID: CVE-2026-80599)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in batadv_dat_get_vid() when processing packet data without ensuring the ethernet header is accessible. A local user can provide a specially crafted skb to trigger an out-of-bounds access and cause a denial of service.

The issue affects distributed arp table handling paths.

1351) Use-after-free (CVE-ID: CVE-2026-80600)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in batman-adv distributed arp table handling in net/batman-adv/distributed-arp-table.c when processing DHCP ACK packets. A local user can trigger skb buffer reallocation and subsequent access through stale pointers to cause a denial of service.

1352) Use-after-free (CVE-ID: CVE-2026-80601)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in batman-adv gateway client handling in net/batman-adv/gateway_client.c when processing a crafted skb after buffer reallocation. A local attacker can trigger skb processing that uses stale buffer pointers to cause a denial of service.

1353) Information disclosure (CVE-ID: CVE-2026-80602)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in the AMD last branch record filtering logic in perf when processing user-only branch stack sampling requests. A local user can collect branch stack records to disclose sensitive information.

Only AMD processors supporting X86_FEATURE_AMD_LBR_V2 are affected.

1354) Out-of-bounds read (CVE-ID: CVE-2026-80603)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incorrect connection tracking state.

The vulnerability exists due to an out-of-bounds read in the parse_dcc() function in nf_conntrack_irc when parsing DCC command data without a newline present. A remote attacker can send specially crafted IRC DCC command data to cause incorrect connection tracking state.

The stray read may consume an uninitialized or stale byte, which can lead to an incorrect DCC IP address or port being recorded in the conntrack expectation.

1355) Integer overflow (CVE-ID: CVE-2026-80605)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in picolcd_send_and_wait() when processing crafted input to the HID device. A local user can trigger excessive loop iterations to cause a NULL pointer dereference and crash the kernel.

1356) Out-of-bounds read (CVE-ID: CVE-2026-80609)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the qede driver qede_tpa_cont and qede_tpa_end handling of cqe->len_list[] when processing crafted CQE data. A local user can trigger access past the end of the len_list array to cause a denial of service.

1357) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-80611)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper handling of function tracing in acpi_idle_lpi_enter() and acpi_processor_ffh_lpi_enter() when entering an ACPI low power idle state with function tracing or Kprobes enabled. A local attacker can trigger idle-state entry on an affected system to cause a denial of service.

The issue is exposed only when function tracing or Kprobes is enabled.

1358) Use-after-free (CVE-ID: CVE-2026-80613)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to a use-after-free in the veth XDP enablement error-handling logic when rolling back queue initialization after failed XDP rxq registration. A local user can trigger XDP enablement failure to cause a use-after-free.

The issue occurs because a previously added NAPI structure is left dangling in the device NAPI list and may later corrupt reallocated memory during device teardown.

1359) Double free (CVE-ID: CVE-2026-80618)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in amdgpu_amdkfd_gpuvm_free_memory_of_gpu() when freeing DOORBELL or MMIO remap buffer objects that remain mapped to GPU memory. A local user can trigger memory free operations on such buffer objects to cause a denial of service.

The issue occurs because the buffer object may be unpinned before the function determines it cannot yet be freed and returns -EBUSY, leaving it to be unpinned again later during process teardown.

1360) Use-after-free (CVE-ID: CVE-2026-80619)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the aa_replace_profiles function when processing profile replacement data. A local user can trigger the vulnerable code path to cause a denial of service.

1361) Double free (CVE-ID: CVE-2026-80620)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double unmap of memory in msix_capability_init() in the PCI/MSI subsystem when handling an error after msix_setup_interrupts() fails. A local user can trigger MSI-X initialization failure to cause a denial of service.

The issue is reachable during MSI-X setup on affected systems.

1362) Use-after-free (CVE-ID: CVE-2026-80622)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in tlclk_cleanup() in the tlclk driver when cleaning up the device while user-space processes are still interacting with it. A local user can keep the device in use during module cleanup to cause a denial of service.

The issue is associated with blocked readers in the wait queue and concurrent timer activity during cleanup.

1363) Out-of-bounds read (CVE-ID: CVE-2026-80624)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the cs42l43 firmware loading code when processing a firmware image smaller than the firmware header. A local user can provide a specially crafted firmware image to cause a denial of service.

1364) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-80626)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in fsl_emb_pmu_del() when removing a perf event with a negative hardware index. A local user can trigger the vulnerable code path to cause a denial of service.

On systems with CONFIG_PREEMPT enabled, the issue can underflow preempt_count and manifest as a "scheduling while atomic" BUG.

1365) Out-of-bounds write (CVE-ID: CVE-2026-80627)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in maar_res_walk() when walking system RAM ranges. A local user can trigger reporting of more than 16 memory ranges to cause a denial of service.

1366) Out-of-bounds write (CVE-ID: CVE-2026-80629)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the octeontx2-af NPC MCAM entry-to-counter mapping logic when handling MCAM entry and counter mapping for reserved entries. A local user can trigger allocation and mapping of a reserved MCAM entry counter to cause a denial of service.

The issue is triggered by AF-reserved MCAM rules such as CPT second-pass entries.

1367) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-80630)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the sch_fq_codel queueing discipline when peeking queued packets after packet drops. A local user can trigger packet drops during peek to cause a denial of service.

The issue can incorrectly invoke the parent qlen_notify callback while a packet still remains queued, which may mistakenly deactivate the parent class and lead to wild memory access in sch_qfq.

1368) Out-of-bounds read (CVE-ID: CVE-2026-80635)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the wcn36xx_smd_trigger_ba_rsp function when parsing a short trigger BA firmware response. A local user can provide a crafted firmware response to cause a denial of service.

The issue occurs when candidate_cnt is at least 1 and the response does not include the required candidate structure data.

1369) NULL pointer dereference (CVE-ID: CVE-2026-80636)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in conntrack extension handling in netfilter when processing unconfirmed conntracks. A remote attacker can trigger code paths that dereference a missing conntrack extension to cause a denial of service.

1370) Type conversion (CVE-ID: CVE-2026-80637)

CWE-ID: CWE-704 - Type conversion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of unaligned memory access in synproxy timestamp adjustment in netfilter synproxy when processing crafted TCP packets with timestamp options. A remote attacker can send specially crafted network packets to cause a denial of service.

The issue may lead to a crash on strict alignment architectures.

1371) Reachable assertion (CVE-ID: CVE-2026-80644)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an assertion misuse in ocfs2_journal_toggle_dirty() in fs/ocfs2/journal.c when mounting a crafted OCFS2 image with an invalid journal dinode. A local user can mount a specially crafted filesystem image to cause a denial of service.

The issue is triggered during mount teardown while mount is still in progress.

1372) Improper Initialization (CVE-ID: CVE-2026-80645)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an improper initialization issue in tsi721_db_dpc() when processing doorbell events. A local user can trigger the vulnerable code path to cause a denial of service.

1373) NULL pointer dereference (CVE-ID: CVE-2026-80646)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in __in6_dev_stats_get() when processing an skb for an l3 master device whose original physical device has been unregistered. A local user can trigger this condition to cause a denial of service.

1374) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-80647)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of completion callbacks in the hns roce completion queue handling logic when processing direct mode completion queues during driver reset. A local user can trigger a driver reset with a direct mode cq present to cause a denial of service.

The issue is triggered specifically when a completion queue is allocated in direct polling mode and the device reset path invokes the completion handler unexpectedly.

1375) Out-of-bounds read (CVE-ID: CVE-2026-80649)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information or cause a denial of service.

The vulnerability exists due to out-of-bounds read in scmi_power_name_get() in the arm_scmi firmware driver when processing an externally supplied domain number. A local user can supply an invalid domain value to disclose sensitive information or cause a denial of service.

1376) Memory leak (CVE-ID: CVE-2026-80650)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in gc2235_probe() error paths in the atomisp gc2235 driver when cleanup is performed after partial initialization failures. A local user can trigger a failing probe path to cause a denial of service.

The issue includes leaked device resources and cleanup routines being invoked for resources that were not initialized on every error path.

1377) Use-after-free (CVE-ID: CVE-2026-80650)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in gc2235_probe() in the atomisp gc2235 driver when handling device initialization errors. A local user can trigger a failing probe path to cause a denial of service.

The issue occurs in driver error-handling paths after partial initialization of subdevice, control handler, or media entity resources.

1378) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-80652)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a zero-length buffer in sev_ioctl_do_pdh_export() when processing a PDH export request. A local user can send a crafted ioctl request with a zero-length certificate chain buffer to cause a denial of service.

The issue results in a kernel BUG when CONFIG_DEBUG_VIRTUAL=y.

1379) Use-after-free (CVE-ID: CVE-2026-80654)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to use-after-free in the rx mailbox channel handling in drivers/soc/xilinx/zynqmp_power.c when processing mailbox messages after device removal. A local user can trigger message delivery to the stale channel to execute arbitrary code.

The issue occurs because the receive mailbox channel may remain active after the device is removed.

1380) Deadlock (CVE-ID: CVE-2026-80659)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock caused by recursive mutex acquisition in the vub300 mmc host driver when handling a command response timeout and resetting the USB device. A local user can trigger a command timeout that leads to a recursive acquisition of cmd_mutex to cause a denial of service.

The issue occurs because the reset path re-enters vub300_pre_reset() while the worker thread still holds cmd_mutex.

1381) Deadlock (CVE-ID: CVE-2026-80660)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock in the occ hwmon sysfs device handling in drivers/hwmon/occ/common.c when unregistering sysfs-backed devices during concurrent sysfs callbacks. A local user can trigger concurrent sysfs access and device shutdown activity to cause a denial of service.

The issue involves circular locking between the OCC mutex and sysfs callback draining during device deactivation or shutdown.

1382) Link following (CVE-ID: CVE-2026-80663)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to overwrite an attacker-chosen file.

The vulnerability exists due to improper link resolution in isst-daemon pidfile handling when opening a pidfile from a fixed path under /tmp. A local user can pre-create a symlink at that path to overwrite an attacker-chosen file.

The issue occurs when a daemon instance is run as root.

1383) NULL pointer dereference (CVE-ID: CVE-2026-80664)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in xt_nat SNAT and DNAT target handlers when installing an unsupported-family compat rule through nft_compat. A local user can instantiate a bridge-family compat rule to cause a denial of service.

The issue is triggered in nf_nat_setup_info() because the handlers assume IP-family conntrack state is present.

1384) Improper locking (CVE-ID: CVE-2026-80667)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in mlx5_mpesw_work() when handling a missing devcom component. A local user can trigger the affected work path to cause a denial of service.

The issue can cause a caller waiting on mpesww->comp to block indefinitely.

1385) Improper access control (CVE-ID: CVE-2026-80669)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper access control in the bpf lsm hook attachment handling for xfrm_decode_session when attaching a bpf lsm program to the xfrm_decode_session hook. A local privileged user can attach a crafted bpf lsm program that returns an error to cause a denial of service.

The issue is triggered because security_skb_classify_flow() invokes the hook from a void path and reaches BUG_ON() if an error is returned.

1386) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-80671)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exceptional condition handling in register_pid() in tools/perf/builtin-sched.c when reallocating sched->tasks while processing untrusted perf.data. A local user can supply crafted input that triggers realloc failure to cause a denial of service.

Direct reassignment of the realloc result can leak the original pointer and leave task state corrupted because the task count is updated before successful reallocation.

1387) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-80671)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exceptional condition handling in register_pid() in tools/perf/builtin-sched.c when processing untrusted perf.data that triggers allocation failure. A local user can supply crafted input that causes an allocation failure to cause a denial of service.

The issue is triggered because allocation failures are handled with a BUG_ON condition that terminates the process.

1388) Heap-based buffer overflow (CVE-ID: CVE-2026-80671)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to heap-based buffer overflow in register_pid() in tools/perf/builtin-sched.c when processing an untrusted comm string from perf.data. A local user can supply a crafted perf.data file containing an oversized comm value to cause a denial of service.

The overflow occurs because the comm value is copied into a fixed 20-byte COMM_LEN buffer without a length check.

1389) Integer overflow (CVE-ID: CVE-2026-80671)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in register_pid() in tools/perf/builtin-sched.c when processing untrusted perf.data. A local user can supply a crafted perf.data file with a large pid value to cause a denial of service.

The integer overflow can occur on 32-bit systems and may lead to out-of-bounds writes during task array initialization.

1390) Use-after-free (CVE-ID: CVE-2026-80676)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the vmbus driver matching logic when probing a driver through __driver_attach__(). A local user can trigger access to the driver_override field without proper locking to cause a denial of service.

The issue occurs because the bus match callback can access the field without the device lock being held.

1391) Race condition (CVE-ID: CVE-2026-80677)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in dev_has_sync_state() in the driver core when checking and dereferencing dev->driver without holding the device lock. A local user can trigger a concurrent unbind condition to cause a denial of service.

1392) Race condition (CVE-ID: CVE-2026-80678)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in i2c_imx_reg_slave() and i2c_imx_isr() when registering an i2c slave device and handling shared interrupts. A local user can trigger concurrent slave registration and interrupt handling to cause a denial of service.

The issue can result in subsequent registration attempts failing with -EBUSY or in a NULL pointer dereference in the interrupt handler.

1393) NULL pointer dereference (CVE-ID: CVE-2026-80679)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in dasd_release_space() in drivers/s390/block/dasd_ioctl.c when handling a release space operation on a DASD device. A local user can trigger the vulnerable code path to cause a denial of service.

1394) Use-after-free (CVE-ID: CVE-2026-80680)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the amd mp2 i2c platform driver callback handling when i2c_add_adapter() fails during adapter registration. A local user can trigger adapter registration failure and subsequent callback dereference to cause a denial of service.

The stale pointer may be dereferenced from IRQ and system-sleep callbacks after the platform I2C context has been freed.

1395) Use-after-free (CVE-ID: CVE-2026-80681)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in vxlan_xmit() in drivers/net/vxlan/vxlan_core.c when processing packets through route_shortcircuit(). A local user can trigger skb head reallocation and subsequent dereference of a stale ethernet header pointer to cause a denial of service.

1396) NULL pointer dereference (CVE-ID: CVE-2026-80684)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in arch/s390/kvm/pci.c when enabling adapter interruption forwarding for a PCI device after AIBV allocation fails. A local user can trigger the vulnerable code path to cause a denial of service.

1397) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-80686)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of non-present page table entries in migrate_vma_collect_pmd() when processing page migration entries. A local user can trigger page migration involving non-present PTEs to cause a denial of service.

The issue can also result in incorrect dirty folio accounting.

1398) NULL pointer dereference (CVE-ID: CVE-2026-80689)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the mmiotrace logging functions __trace_mmiotrace_rw() and __trace_mmiotrace_map() when handling mmiotrace events while mmio_trace_array is NULL. A local user can trigger the affected tracing functionality to cause a denial of service.

This can occur before initialization or after the tracing facility has been disabled.

1399) NULL pointer dereference (CVE-ID: CVE-2026-80691)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in iblock_execute_pr_out() in the iblock SCSI target component when handling persistent reservation PREEMPT, PREEMPT_AND_ABORT, or RELEASE operations. A local user can invoke crafted persistent reservation operations to cause a denial of service.

1400) Type Confusion (CVE-ID: CVE-2026-80694)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper type handling in mtk_poll_controller and mtk_handle_irq_rx when handling ndo_poll_controller calls with CONFIG_NET_POLL_CONTROLLER enabled. A local user can trigger ndo_poll_controller to cause a denial of service.

The issue results from passing a net_device pointer where a struct mtk_eth pointer is expected.

1401) Type conversion (CVE-ID: CVE-2026-80695)

CWE-ID: CWE-704 - Type conversion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to unaligned memory access in the sht3x driver when processing sensor data. A local user can trigger an alignment fault to cause a denial of service.

The issue can result in a kernel panic on strict-alignment architectures such as ARMv5 or SPARC.

1402) Out-of-bounds write (CVE-ID: CVE-2026-80700)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds write in vmw_external_bo_copy() when processing a crafted atomic commit on an imported framebuffer. A local user can submit crafted STDU/SOU plane state values to trigger out-of-bounds access and cause a denial of service.

Exploitation requires a configured CRTC and reaches the vulnerable path through imported dma-buf mappings.

1403) Out-of-bounds write (CVE-ID: CVE-2026-80702)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read and out-of-bounds write in vmwgfx_resource.c when handling resource release and unbind operations. A local user can trigger the vulnerable code paths to cause a denial of service.

The issue is caused by assignments to the guest_memory_size field instead of the adjacent guest_memory_dirty bitfield, which can lead to zero-length walks or wrap-around ranges while processing the MOB bitmap.

1404) Missing Authorization (CVE-ID: CVE-2026-80703)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to interfere with another process's active GPU debug session.

The vulnerability exists due to improper access control in KFD_IOC_DBG_TRAP_DISABLE in the amdkfd kfd chardev ioctl handler when processing a debug trap disable request for another process. A local user can invoke the ioctl through /dev/kfd to interfere with another process's active GPU debug session.

The issue affects cross-process debug operations and occurs when the caller lacks ownership or an active ptrace authorization for the target process.

1405) NULL pointer dereference (CVE-ID: CVE-2026-80704)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in get_ss_info_from_atombios(), dce112_get_pix_clk_dividers(), and dcn3_get_pix_clk_dividers() when performing AMD display clock source operations. A local user can trigger the vulnerable code path to cause a denial of service.

1406) Out-of-bounds write (CVE-ID: CVE-2026-80706)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the application Softing CAN firmware loader staging copy when processing firmware-provided record data for DPRAM staging. A local user can provide a crafted firmware record to cause a denial of service.

The application loader does not bound the staging copy against the mapped DPRAM before copying.

1407) Out-of-bounds write (CVE-ID: CVE-2026-80706)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the generic Softing CAN firmware loader DPRAM copy logic when processing firmware-provided DPRAM addresses and lengths. A local user can supply crafted address and length values to cause a denial of service.

The bounds check uses wrap-prone mixed signed arithmetic for generic DPRAM records.

1408) Out-of-bounds read (CVE-ID: CVE-2026-80706)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in fw_parse() in the Softing CAN firmware loader when parsing a crafted firmware blob. A local user can provide a truncated firmware record to cause a denial of service.

The issue is triggered while processing firmware records composed of a header, payload, and trailing checksum.

1409) Improper Initialization (CVE-ID: CVE-2026-80707)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper initialization in j1939_session_fresh_new() in the can j1939 transport component when allocating a receive buffer. A local user can trigger allocation of a buffer containing residual data to disclose sensitive information.

1410) Sensitive Information in Resource Not Removed Before Reuse (CVE-ID: CVE-2026-80708)

CWE-ID: CWE-226 - Sensitive Information in Resource Not Removed Before Reuse

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper clearing of sensitive information in _ip_cprb_helper() and cca_clr2cipherkey() when processing clear key import requests. A local user can trigger clear key import operations and expose residual clear key material from reused memory to disclose sensitive information.

The issue affects internal CPRB buffer memory as well as the random EXOR buffer used during the clear key to secure key token import process.

1411) Out-of-bounds read (CVE-ID: CVE-2026-80709)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the EP11 CPRB handling in zcrypt_api.c when processing an administrative CPRB on custom device nodes. A local user can send a crafted administrative CPRB with an invalid domain value to disclose sensitive information.

The issue is only active on custom device nodes.

1412) Integer overflow (CVE-ID: CVE-2026-80710)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow leading to an undersized allocation in dasd_eckd_check_device_format() when processing caller-controlled track ranges. A local user can provide a sufficiently large start and stop unit range to trigger a buffer overflow and cause a denial of service.

The issue occurs because the computed buffer size is truncated before allocation, while subsequent operations use the full untruncated track count.

1413) Use of Uninitialized Variable (CVE-ID: CVE-2026-80711)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of uninitialized data in max17040_get_property() in the max17040 battery driver when handling POWER_SUPPLY_PROP_STATUS without a registered supplier power supply. A local user can read the battery power supply status from userspace to disclose sensitive information.

This occurs on systems that use the fuel gauge without a charger supplier relationship in firmware.

1414) Use-after-free (CVE-ID: CVE-2026-80714)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ipvs connection handling logic when binding synced connections to a destination. A local user can trigger creation and expiry of a crafted synced connection state to cause a denial of service.

The issue occurs when a synced connection inherits the one-packet flag after it is already hashed, which can leave stale hash nodes pointing to a freed struct ip_vs_conn.

1415) Improper locking (CVE-ID: CVE-2026-80715)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in igc_down() when tearing down an AF_XDP zero-copy application abruptly. A local user can abruptly terminate an AF_XDP zero-copy application to cause a denial of service.

The issue occurs because NAPI keeps polling and the network interface may never go down.

1416) Use-after-free (CVE-ID: CVE-2026-80716)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in snd_pcm_drain() and snd_pcm_unlink() in the ALSA PCM subsystem when unlinking a drained or draining linked stream while a drain wait is pending. A local user can trigger stream unlinking to cause a denial of service.

The issue occurs when group membership changes during the wait and the wait ends by signal or timeout, leaving an on-stack wait entry queued on a sleep list.

1417) Out-of-bounds read (CVE-ID: CVE-2026-80717)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in sctp_process_param() when processing a malformed SCTP Adaptation Layer Indication parameter in an INIT chunk. A remote attacker can send a specially crafted SCTP INIT request to disclose sensitive information.

When the malformed parameter is the last parameter in the INIT chunk, four bytes from the receive-buffer tail may be copied into the state cookie returned in the INIT ACK.

1418) Out-of-bounds write (CVE-ID: CVE-2026-80718)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in pcpu_create_chunk() when initializing the populated bitmap for percpu chunks with more than one unit. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs because a total backing allocation page count is used to update a bitmap sized only for per-unit page offsets.

1419) Out-of-bounds read (CVE-ID: CVE-2026-80722)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in mac80211 TWT setup handling when processing a received S1G TWT setup frame. A remote attacker can send a specially crafted TWT setup frame with an individual agreement and a truncated parameters block to cause a denial of service.

Broadcast agreements are rejected locally after accessing only req_type.

1420) Improper Initialization (CVE-ID: CVE-2026-80727)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger kernel warnings.

The vulnerability exists due to improper initialization of the polling timer in x86 machine-check exception handling when CMCI storm detection runs during machine check initialization. A local user can trigger CMCI storm detection before the polling timer is initialized to trigger kernel warnings.

1421) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-80730)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an improper check for exceptional conditions in the ring-buffer self-test cleanup loop when handling a failed kthread creation. A local user can trigger cleanup after kthread_run_on_cpu() returns an error pointer to cause a denial of service.

The issue occurs during the late_initcall self-test.

1422) Out-of-bounds write (CVE-ID: CVE-2026-80731)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in dev_validate_header when validating short link-layer headers after a network device's hard_header_len increases. A local privileged user can trigger zero-padding of a short link-layer header to cause memory corruption.

The affected path is limited to variable-length layer-2 protocols where the header length is at least min_header_len but shorter than hard_header_len.

1423) Use-after-free (CVE-ID: CVE-2026-80732)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access freed memory.

The vulnerability exists due to use-after-free in the sl82c105_bridge_revision function of the pata_sl82c105 driver when reading a PCI bridge revision after releasing the PCI device reference. A local user can trigger bridge revision handling to access freed memory.

1424) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-80733)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to improper handling of unsupported socket families in sk_mc_loop() when sending packets through an AF_PACKET socket over a virtual device. A local user can send packets through a raw or packet socket to trigger a kernel warning.

The issue affects non-INET sockets, including AF_PACKET sockets used with virtual devices such as VRF or ipvlan.

1425) Use-after-free (CVE-ID: CVE-2026-80737)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to a use-after-free in the AMBA PL011 serial driver's DMA shutdown handling when DMA activity is being terminated. A local user can trigger DMA shutdown while TX callbacks or RX polling remain active to cause memory corruption.

1426) Deadlock (CVE-ID: CVE-2026-80739)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper lock management in mlx5e_tc_del_flow() when deleting a peer TC flow after lower-level FDB flow creation fails. A local privileged user can configure a traffic-control flower filter that creates a peer flow to cause a denial of service.

1427) Improper input validation (CVE-ID: CVE-2026-80742)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to improper input validation in tpacket_fill_skb() in the AF_PACKET subsystem when sending zero-byte packets through a TPACKET ring buffer. A local user can send a zero-byte packet through the TPACKET ring buffer to trigger a kernel warning.

The issue occurs on devices with no hard header.

1428) NULL pointer dereference (CVE-ID: CVE-2026-80743)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization of IRQ handler data in the Xilinx formatter PCM IRQ handlers when an interrupt occurs after IRQ registration and before driver data is set. A local user can trigger an interrupt during device probing to cause a denial of service.

1429) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-80744)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a kernel warning.

The vulnerability exists due to improper handling of expected memory allocation failures in nft_flow_rule_offload_abort() in nf_tables_offload when processing a netfilter transaction rollback. A local user can process a netfilter transaction that encounters an -ENOMEM error to cause a kernel warning.

Exploitation requires memory pressure or fault injection to cause the memory allocation failure.

1430) NULL pointer dereference (CVE-ID: CVE-2026-80752)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the psxpad_spi_suspend() function of the psxpad-spi driver when the system suspends. A local user can trigger a system suspend to cause a denial of service.

1431) Out-of-bounds write (CVE-ID: CVE-2026-80754)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect transmitter electrode count assignment in the Synaptics RMI4 F55 driver when F55 sensor detection handles a device with more receiver than transmitter electrodes. A local user can trigger F55 sensor detection to cause a denial of service.

The incorrect transmitter count is propagated to F54 for diagnostic report size calculations.

1432) Out-of-bounds write (CVE-ID: CVE-2026-80755)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds heap write.

The vulnerability exists due to an out-of-bounds write in the SELinux policy permission parser when processing a policy image in which a class declares fewer permissions than its largest permission value. A local user can supply a crafted policy containing such a permission declaration to perform an out-of-bounds heap write.

1433) NULL pointer dereference (CVE-ID: CVE-2026-80756)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in selinux_policy_cancel() when writing a policy during an initial SELinux policy load that fails while building the selinuxfs tree. A local user can write policy data to /sys/fs/selinux/load to cause a denial of service.

1434) Out-of-bounds write (CVE-ID: CVE-2026-80757)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause memory corruption.

The vulnerability exists due to an out-of-bounds heap write in the SELinux security_get_permissions() function when loading a crafted SELinux policy. A local privileged user can load a policy containing a class whose permission count is lower than that of its inherited common to cause memory corruption.

1435) Use-after-free (CVE-ID: CVE-2026-80762)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Bluetooth hci_update_event_filter_sync() accept-list handling when suspending a Bluetooth controller while an accept-list device is concurrently removed. A local user can trigger concurrent accept-list removal during a controller wait to cause a denial of service.

1436) Out-of-bounds read (CVE-ID: CVE-2026-80763)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in the hci_cc_le_set_cig_params() handler when processing a truncated LE Set CIG Parameters response. A remote attacker can provide a malformed response with an advertised handle count that exceeds the remaining response data to perform an out-of-bounds read.

1437) Use-after-free (CVE-ID: CVE-2026-80764)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in the Bluetooth HCI event handler's LE accept and resolving list handling when a debugfs reader accesses a list entry concurrently with reset completion. A local user can read Bluetooth LE lists through debugfs while reset completion frees a current list entry to trigger a use-after-free condition.

Exploitation requires a concurrent reset completion and read access to the relevant debugfs entries.

1438) Out-of-bounds read (CVE-ID: CVE-2026-80765)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in mousevsc_on_receive_device_info() in the Hyper-V HID driver when processing SYNTH_HID_INITIAL_DEVICE_INFO messages. A local privileged user can send a short initial device-info message with an oversized HID report descriptor length to cause a denial of service.

Exploitation requires control of the Hyper-V host or backend.

1439) Use-after-free (CVE-ID: CVE-2026-80766)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to trigger a use-after-free condition.

The vulnerability exists due to a race condition in the uclogic HID driver's in-range timer teardown when processing pen reports during device removal. An attacker with physical access can send pen reports during device removal to trigger a use-after-free condition.

The freed memory is dereferenced in timer-softirq context.

1440) Use-after-free (CVE-ID: CVE-2026-80767)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the HID sensor custom driver's enable_sensor sysfs attribute handling when writing to the enable_sensor sysfs attribute while the driver is being initialized or removed. A local user can write to the enable_sensor sysfs attribute during this condition to cause a denial of service.

1441) Use-after-free (CVE-ID: CVE-2026-80768)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 1 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to a race condition causing a stack-use-after-return write in the FT260 HID driver's I2C read handling when a device response arrives after an I2C read times out. An attacker with physical access can provide a delayed device response containing an attacker-influenced payload to cause memory corruption.

1442) Use-after-free (CVE-ID: CVE-2026-80770)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to trigger a use-after-free.

The vulnerability exists due to improper device I/O cleanup in nintendo_hid_probe() when probe initialization fails after device I/O has started. An attacker with physical access can provide input reports during error handling to trigger a use-after-free.

1443) Race condition (CVE-ID: CVE-2026-80771)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the Nintendo HID driver's joycon_input_create() function when handling concurrent EVIOCSFF ioctls during input-device initialization. A local user can issue a concurrent EVIOCSFF ioctl to dereference a NULL force-feedback device pointer and cause a denial of service.

1444) Out-of-bounds read (CVE-ID: CVE-2026-80772)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose driver-internal memory.

The vulnerability exists due to an out-of-bounds read in joycon_ctlr_read_handler() when processing an undersized IMU HID input report. An attacker with physical access can provide a specially crafted HID input report to disclose driver-internal memory.

1445) Type conversion (CVE-ID: CVE-2026-80774)

CWE-ID: CWE-704 - Type conversion

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper validation of a HID device's USB parent in the ASUS HID driver when handling a uhid-created device that identifies as being on BUS_USB. A local user can create a uhid device with a non-USB parent to trigger a kernel splat and cause a denial of service.

1446) Out-of-bounds write (CVE-ID: CVE-2026-80780)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in hid_pidff_init_with_quirks() when initializing force feedback for a malicious USB HID device with an empty inputs list. An attacker with physical access can connect a malicious USB HID device to cause memory corruption.

The issue is reachable during device probing on the hotplug workqueue.

1447) Out-of-bounds read (CVE-ID: CVE-2026-80781)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to read memory beyond the bounds of a HID usage array.

The vulnerability exists due to an out-of-bounds read in hid_set_field() when processing an offset for a HID field. An attacker with physical access can attach a HID device that registers a field with fewer usages than the offsets used by picolcd_fb_send_tile() to read memory beyond the bounds of a HID usage array.

The out-of-bounds dereference occurs when CONFIG_DEBUG_FS is enabled during framebuffer deferred-io work.

1448) Use-after-free (CVE-ID: CVE-2026-80782)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.1 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to use-after-free in the HID magicmouse driver when processing input reports after HID input-device connection failure. An attacker with physical access can cause a subsequent input report to be processed to cause a denial of service.

The affected execution paths are for USB Magic Mouse 2 and Magic Trackpad 2 devices, where hidraw and hiddev remain claimed.

1449) Stack-based buffer overflow (CVE-ID: CVE-2026-80783)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service or memory corruption.

The vulnerability exists due to a stack-based buffer overflow in magicmouse_raw_event() when processing a crafted HID report containing nested DOUBLE_REPORT_ID packets. An attacker with physical access can send a crafted HID report to cause a denial of service or memory corruption.

1450) Race condition (CVE-ID: CVE-2026-80784)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in MPTCP path manager announcement and userspace local-address list allocation when processing concurrent userspace PM generic netlink ANNOUNCE requests during MPTCP socket teardown. A local user can issue concurrent ANNOUNCE requests while closing an MPTCP socket to cause a denial of service.

1451) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-80788)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource allocation in nvmet_tcp_map_data() when processing a command containing an oversized SGL. A remote attacker can send a command with an oversized SGL to cause a denial of service.

Systems configured to panic on kernel warnings can panic when the allocation triggers a page-allocator warning.

1452) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-80789)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource allocation in nvmet_tcp_map_data() when processing write commands containing non-inline transport SGL data-block descriptors. A remote attacker can submit a crafted NVMe/TCP command with an oversized SGL length to cause a denial of service.

For write commands, the target waits for host data after issuing an R2T response.

1453) Release of invalid pointer or reference (CVE-ID: CVE-2026-80790)

CWE-ID: CWE-763 - Release of invalid pointer or reference

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an invalid memory free.

The vulnerability exists due to improper pointer handling in nvmet_fc_alloc_ls_iodlist() when handling request-buffer allocation or response-buffer DMA mapping failures while initializing the LS IOD array. A local user can create a target port under these failure conditions to trigger an invalid memory free.

1454) Use of uninitialized resource (CVE-ID: CVE-2026-80791)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to use of uninitialized memory in nvmet_execute_auth_receive() when processing a host-supplied AUTH_RECEIVE allocation length. A remote attacker can send a crafted AUTH_RECEIVE request to disclose sensitive information.

1455) Use-after-free (CVE-ID: CVE-2026-80792)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive kernel data, pollute the neighbour table with arbitrary values, misdirect traffic, or cause a denial of service.

The vulnerability exists due to a use-after-free in ip6_finish_output2() when lwtunnel_xmit() returns LWTUNNEL_XMIT_CONTINUE after reallocating the skb head. A local user can trigger IPv6 packet output through an affected lwtunnel transmission path to disclose sensitive kernel data, pollute the neighbour table with arbitrary values, misdirect traffic, or cause a denial of service.

1456) Infinite loop (CVE-ID: CVE-2026-80793)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper validation of the effective MTU in ip_do_fragment() when fragmenting IPv4 packets with an effective MTU smaller than the IPv4 header length plus 8 bytes. A remote attacker can send a packet requiring fragmentation over an affected route or device to cause a denial of service.

The issue can occur while forwarding packets to a device with an MTU of 20 bytes.

1457) Use of Uninitialized Variable (CVE-ID: CVE-2026-80794)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to use of uninitialized stack memory in the RF discover and RF interface activated notification handlers when processing notifications with zero-length RF technology-specific parameters. A remote attacker can cause the kernel to process a notification reporting zero-length RF technology-specific parameters to disclose sensitive information.

The copied target data is exposed to user space through NFC_CMD_GET_TARGET.

1458) Out-of-bounds write (CVE-ID: CVE-2026-80795)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a slab out-of-bounds write.

The vulnerability exists due to a missing bounds check in nci_target_auto_activated() when processing RF_INTF_ACTIVATED_NTF notifications after repeated discovery cycles. A local user can trigger repeated NFC discovery cycles with auto-activated targets to cause a slab out-of-bounds write.

The target list remains populated when RF_DISCOVER_RSP re-enters NCI_DISCOVERY.

1459) Out-of-bounds read (CVE-ID: CVE-2026-80796)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read kernel memory beyond activation parameter data.

The vulnerability exists due to improper bounds checking in the NCI activation parameter extractors when processing a crafted NCI RF_INTF_ACTIVATED_NTF notification. A remote attacker can send a crafted NCI notification with an inconsistent inner length byte to read kernel memory beyond activation parameter data.

1460) Memory leak (CVE-ID: CVE-2026-80797)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to leak memory.

The vulnerability exists due to improper cleanup of queued fragment skbs in pn53x_common_clean() when a device is removed while transmit fragments are queued. An attacker with physical access can remove a device while transmit fragments are queued to leak memory.

1461) Out-of-bounds read (CVE-ID: CVE-2026-80798)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read memory out of bounds.

The vulnerability exists due to insufficient length validation in the LLCP receive path when processing an LLCP PDU shorter than the LLCP header. A remote attacker can send a crafted undersized LLCP PDU to read memory out of bounds.

LLCP link activation occurs automatically after NFC-DEP.

1462) Out-of-bounds read (CVE-ID: CVE-2026-80799)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read out-of-bounds memory or cause a denial of service.

The vulnerability exists due to improper bounds checking and integer wraparound in the nfc_llcp_parse_gb_tlv() and nfc_llcp_parse_connection_tlv() functions when processing remote LLCP general bytes. A remote attacker can send malformed TLV data to trigger out-of-bounds reads or infinite parsing loops.

1463) Out-of-bounds read (CVE-ID: CVE-2026-80800)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in nfc_llcp_connect_sn() when processing received CONNECT and CC PDUs. A remote attacker can send a malformed NFC LLCP PDU to read out-of-bounds memory.

LLCP link activation occurs automatically after NFC-DEP.

1464) Out-of-bounds read (CVE-ID: CVE-2026-80801)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in microread_target_discovered() when processing malformed NFC target discovery payloads. A remote attacker can send a malformed target discovery payload to read out-of-bounds memory.

1465) Memory leak (CVE-ID: CVE-2026-80802)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper memory management in fdp_nci_i2c_read() when processing multiple data packets in one call. An attacker with physical access can send two data packets in one call to cause a denial of service.

1466) Out-of-bounds read (CVE-ID: CVE-2026-80802)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper validation of a device-reported length in fdp_nci_i2c_read() when processing a packet with a declared length below the minimum frame size. An attacker with physical access can provide a packet with a declared length below the minimum frame size to cause a denial of service.

1467) Stack-based buffer overflow (CVE-ID: CVE-2026-80802)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper validation of a device-reported length in fdp_nci_i2c_read() when processing a packet with an oversized declared length. An attacker with physical access can provide a packet with an oversized declared length to cause a denial of service.

1468) Stack-based buffer overflow (CVE-ID: CVE-2026-80803)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt stack memory.

The vulnerability exists due to improper length validation in the digital_in_recv_sensf_res() function when processing an NFC-F device response. A remote attacker can send an oversized SENSF_RES response to corrupt stack memory.

1469) Out-of-bounds read (CVE-ID: CVE-2026-80805)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in xfs_attr3_leaf_verify_entry() when validating crafted XFS attribute entries. A local user can provide a crafted name index to read out-of-bounds memory.

1470) Missing Encryption of Sensitive Data (CVE-ID: CVE-2026-80806)

CWE-ID: CWE-311 - Missing Encryption of Sensitive Data

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause sensitive data to be stored without encryption.

The vulnerability exists due to incorrect initialization order of encryption flags in the ext4 __ext4_new_inode() function when creating a new encrypted regular file on an ext4 filesystem mounted with dax=always. A local user can create a new encrypted regular file and write data to it to cause sensitive data to be stored without encryption.

1471) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-80807)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause list corruption.

The vulnerability exists due to improper range validation in the nilfs2 GC ioctl when processing crafted virtual block descriptors. A local user can submit a crafted GC ioctl request to cause list corruption.

The crafted descriptor can specify an invalid virtual block number or offset that results in a page index of ULONG_MAX.

1472) Infinite loop (CVE-ID: CVE-2026-80808)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an infinite retry loop in ext4_xattr_block_set() when reusing a saturated extended attribute cache entry on a corrupted filesystem. A local user can trigger repeated selection of the unusable cache entry to cause a denial of service.

Concurrent rmdir callers can remain blocked while the spinning task holds the parent directory's i_rwsem.

1473) Reachable assertion (CVE-ID: CVE-2026-80809)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to missing metadata reservation in the OCFS2 extended attribute allocation code when setting a large extended attribute value on a fragmented filesystem for a file that already has an external extended attribute block. A local user can set a large extended attribute value to cause a denial of service.

1474) Out-of-bounds read (CVE-ID: CVE-2026-80812)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read.

The vulnerability exists due to improper validation in snd_dummy_probe() of the ALSA dummy driver when a platform device is manually bound through the sysfs interface with an invalid card index. A local user can bind a platform device with a card index of -1 to cause an out-of-bounds read.

1475) Out-of-bounds read (CVE-ID: CVE-2026-80814)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to read out-of-bounds data.

The vulnerability exists due to an integer overflow in the rndis_rx_fixup() function when processing a crafted RNDIS message received over USB. An attacker with physical access can supply a crafted RNDIS message with overflowing data offset and length values to read out-of-bounds data.

1476) Improper Initialization (CVE-ID: CVE-2026-80815)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper initialization in ALSA scarlett2 notification endpoint handling when initializing a Scarlett2 device with a UAC2 status interrupt endpoint. An attacker with physical access can initialize the device to cause a denial of service.

1477) NULL pointer dereference (CVE-ID: CVE-2026-80819)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper synchronization in the RFCOMM deferred setup acceptance path when processing a recvmsg call after a remote DISC frame is received for a deferred data link connection. A remote attacker can send a DISC frame to a deferred RFCOMM data link connection to cause a denial of service.

1478) Infinite loop (CVE-ID: CVE-2026-80820)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of circular linked lists in the XFS scrub unlinked inode list traversal when online filesystem checking processes an unlinked inode list containing a loop. A local user can cause online filesystem checking to traverse the circular list to cause a denial of service.

1479) Out-of-bounds read (CVE-ID: CVE-2026-80823)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose kernel memory or cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the st21nfca_tm_recv_atr_req() and st21nfca_tm_send_atr_res() ATR_REQ handling path when handling ATR_REQ frames whose declared length exceeds the received frame length. A remote attacker can send a short ATR_REQ frame with an oversized declared length to disclose kernel memory or cause a denial of service.

Exploitation requires an RF peer.

1480) Use-after-free (CVE-ID: CVE-2026-80824)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in usbdev_release() in usbfs when draining completed asynchronous URBs after a USB device is disconnected. A local user can mmap a usbfs device node and submit an asynchronous URB using a mapped buffer before unmapping and closing the associated file descriptor to cause a denial of service.

1481) Incorrect Calculation of Buffer Size (CVE-ID: CVE-2026-80825)

CWE-ID: CWE-131 - Incorrect Calculation of Buffer Size

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of packet buffer headroom in mt7925_usb_sdio_tx_prepare_skb() when forwarding frames from a bridged wired interface to an mt7925u access point. A remote attacker can send a frame that is forwarded through the bridge to cause a denial of service.

1482) Use-after-free (CVE-ID: CVE-2026-80826)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to use-after-free in c67x00_add_iso_urb() when processing an isochronous URB whose final packet encounters TD creation failure. A local user can submit such an isochronous URB to cause a use-after-free condition.

1483) Out-of-bounds read (CVE-ID: CVE-2026-80827)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to read memory out of bounds.

The vulnerability exists due to improper length validation in the option_instat_callback interrupt URB callback when processing a short interrupt IN packet from a USB device. An attacker with physical access can provide a USB device that sends a crafted short interrupt IN packet to read memory out of bounds.

1484) Improper handling of exceptional conditions (CVE-ID: CVE-2026-80828)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper handling of exceptional conditions in the ALSA USB-audio usb_audio_resume() function when processing system-resume failures. An attacker with physical access can trigger a system resume while a USB audio component resume operation fails to cause a denial of service.

The condition applies to system-resume errors; runtime-resume errors follow a distinct error path.

1485) Out-of-bounds write (CVE-ID: CVE-2026-80829)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in snd_usbmidi_novation_output() when handling USB MIDI output from a device with an undersized bulk OUT endpoint. An attacker with physical access can connect a malicious USB device that advertises a one-byte bulk OUT endpoint to cause memory corruption.

1486) Use-after-free (CVE-ID: CVE-2026-80830)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to a race condition in usb_wakeup_notification() when an xHCI IRQ invocation occurs concurrently with hub_disconnect(). A local user can trigger concurrent wakeup notification and device disconnection activity to trigger a use-after-free condition.

1487) Incorrect calculation (CVE-ID: CVE-2026-80831)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause encryption and decryption operations to process an incorrect number of bytes.

The vulnerability exists due to improper use of an unmapped DMA scatterlist length in mxs_dcp_aes_block_crypt() when processing source scatterlists. A local user can trigger processing of affected source scatterlists to cause encryption and decryption operations to process an incorrect number of bytes.

The issue occurs when CONFIG_NEED_SG_DMA_LENGTH is enabled.

1488) Out-of-bounds read (CVE-ID: CVE-2026-80832)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect CCM authentication tags.

The vulnerability exists due to buffer underallocation in qce_aead_ccm_prepare_buf_assoclen() when preparing CCM associated data. A local user can submit a CCM request with associated data to cause incorrect CCM authentication tags.

1489) Out-of-bounds read (CVE-ID: CVE-2026-80833)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in the sun8i-ss PRNG generate function when updating the PRNG seed after generating random data. A local user can invoke the PRNG generate function to read out-of-bounds memory.

The issue is limited to systems with sun8i-ss PRNG support enabled.

1490) Use-after-free (CVE-ID: CVE-2026-80833)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to failure to stop a DMA operation after an interrupted wait in the sun8i-ss PRNG generate function when a PRNG generation operation is interrupted by a signal. A local user can interrupt a pending PRNG generation operation by sending a signal to cause a use-after-free.

The issue is limited to systems with sun8i-ss PRNG support enabled.

1491) Use-after-free (CVE-ID: CVE-2026-80834)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in the sun8i-ce crypto_rng interface generate function when an in-progress DMA operation is interrupted by a signal. A local user can interrupt an in-progress PRNG generation operation with a signal to trigger a use-after-free condition.

1492) Race condition (CVE-ID: CVE-2026-80835)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause repeated or non-random random-number output.

The vulnerability exists due to improper synchronization in the Qualcomm RNG driver when concurrently using the crypto_rng and hwrng interfaces. A local user can issue concurrent random-number generation operations to cause repeated or non-random random-number output.

1493) Out-of-bounds read (CVE-ID: CVE-2026-80836)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in virtio_crypto_dataq_akcipher_callback() when handling a device-reported akcipher response length. A local user can cause a virtio crypto backend to report an oversized result length to disclose sensitive information.

1494) Use-after-free (CVE-ID: CVE-2026-80837)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a use-after-free write.

The vulnerability exists due to a race condition in the nf_tables object notification queue when sending packets through a chain that references a depleted quota object. A remote attacker can send packets through the affected chain to trigger a use-after-free write.

1495) Race condition (CVE-ID: CVE-2026-80838)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to a race condition in vxlan FDB flush handling when flushing filtered FDB entries whose sole remote matches. A local user can trigger a filtered bulk FDB flush while an RCU reader accesses the parent FDB entry to cause memory corruption.

1496) Numeric Truncation Error (CVE-ID: CVE-2026-80839)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read memory beyond the packet buffer.

The vulnerability exists due to numeric truncation in batadv_tvlv_call_handler() when processing a received multicast TVLV with an unrepresentable end offset. A remote attacker can send a multicast TVLV with an oversized end offset to read memory beyond the packet buffer.

1497) Out-of-bounds write (CVE-ID: CVE-2026-80840)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an out-of-bounds write.

The vulnerability exists due to improper initialization of the IPv4 control block in the IPv6 Segment Routing decapsulation path when processing a specially crafted IPv6 packet containing an encapsulated IPv4 TCP SYN packet. A remote attacker can send a specially crafted packet with controlled IPv6 extension-header and IPv4 option data to cause an out-of-bounds write.

1498) Use-after-free (CVE-ID: CVE-2026-80841)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in AF_PACKET TX_RING handling when closing a socket or replacing a transmit ring while transmit skbs remain pending. A local user can close a socket or replace a transmit ring while transmit skbs remain pending to cause a denial of service.

The issue is limited to vmalloc-backed transmit-ring blocks.

1499) Use-after-free (CVE-ID: CVE-2026-80842)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2.3 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to use-after-free in the Linux bridge multicast handling for master VLANs when processing IGMP traffic during master VLAN teardown. A remote attacker can send IGMP traffic to the bridge device while a master VLAN is being removed to cause memory corruption.

1500) Memory leak (CVE-ID: CVE-2026-80843)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory management in xfrm_state_construct() when constructing an XFRM state with a truncated authentication algorithm. A local user can trigger XFRM state construction using a truncated authentication algorithm to cause a denial of service.

The issue occurs when the selected authentication algorithm has no sadb_alg_id, such as cmac(aes).

1501) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-80844)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds memory access.

The vulnerability exists due to improper validation of routing header segments_left values in ipv6_rearrange_rthdr() when processing raw IPv6 HDRINCL packets with a segments_left value larger than the number of addresses described by hdrlen. A local user can send a crafted packet with an oversized segments_left value to cause an out-of-bounds memory access.

1502) NULL pointer dereference (CVE-ID: CVE-2026-80846)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the handle_esp function when processing queued ESP-in-TCP data after its ingress device has been removed. A remote attacker can send ESP-in-TCP records to cause a denial of service.

The condition can occur during veth or network namespace teardown.

1503) Division by zero (CVE-ID: CVE-2026-80847)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a divide-by-zero error in tcp_select_initial_window() when processing route-derived advertised MSS values. A local user can configure a route with a too-small RTAX_ADVMSS value to cause a denial of service.

The default advertised MSS path is also affected when the effective advertised MSS is reduced by the route MTU and min_adv_mss.

1504) Use-after-free (CVE-ID: CVE-2026-80848)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in the espintcp_close routine when closing espintcp sockets while queued reinjection work is running. A local user can race socket closure against queued reinjection work to trigger a use-after-free condition.

1505) Use-after-free (CVE-ID: CVE-2026-80849)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access freed memory.

The vulnerability exists due to use-after-free in current_key handling in the TCP Authentication Option (TCP-AO) code when processing inbound TCP-AO traffic during a socket reconnect to a different peer. A local user can race inbound TCP-AO processing with reconnecting a socket to another peer to access freed memory.

1506) Use-after-free (CVE-ID: CVE-2026-80850)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to use-after-free in TCP-AO information handling in tcp_ao_connect_init() when racing connect() with detaching a veth device from its VRF while sending TCP-AO segments. A local user can trigger access to stale tcp_ao_info data to cause a use-after-free condition.

TCP-AO must be configured.

1507) Race condition (CVE-ID: CVE-2026-80851)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the GTP PDP context deletion paths when concurrently deleting a PDP context through GTP_CMD_DELPDP and network device unregistration. A local user can invoke concurrent GTP_CMD_DELPDP and RTM_DELLINK operations to cause a denial of service.

1508) Out-of-bounds write (CVE-ID: CVE-2026-80852)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in tls_append_frag() in the TLS device offload implementation when repeatedly splicing small amounts of data into a TLS_TX_ZEROCOPY_RO socket using SPLICE_F_MORE and MSG_MORE. A local user can cause the fragment count to exceed the maximum array bound to cause a denial of service.

The vulnerable path requires TLS device offload support.

1509) Use-after-free (CVE-ID: CVE-2026-80854)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the USB gadget f_tcm session teardown path when concurrently unlinking the last LUN and removing a nexus. A local user can overlap last-LUN removal with nexus removal to cause a denial of service.

1510) Improper locking (CVE-ID: CVE-2026-80855)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in fuse_open() in fs/fuse/file.c when fuse_dax_break_layouts() fails after a signal interrupts the wait for busy DAX pages to drain during an O_TRUNC open of a DAX-enabled file. A local user can trigger the affected open operation to cause a denial of service.

The stale lock can stall later faults or truncates on the same file.

1511) Improper locking (CVE-ID: CVE-2026-80856)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock release in fuse_do_setattr() when processing a DAX truncate operation that requires a writeback flush. A local user can initiate such a setattr operation when the writeback flush fails to cause a denial of service.

1512) Improper input validation (CVE-ID: CVE-2026-80861)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the xHCI controller setup routine when initializing an inaccessible xHCI controller. A local user can trigger controller setup while the capability register returns an all-ones value to cause a denial of service.

The issue can cause an alignment fault on arm64 systems.

1513) Out-of-bounds write (CVE-ID: CVE-2026-80863)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in free_rd_atomic_resources() in the RXE RDMA driver when modifying a queue pair's max_dest_rd_atomic setting. A local user can modify a queue pair's max_dest_rd_atomic setting to cause a denial of service.

1514) Use-after-free (CVE-ID: CVE-2026-80864)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the RDMA/rxe responder resource handling when modifying IB_QP_MAX_DEST_RD_ATOMIC while the responder task is active. A local user can race the freeing and reallocation of rd_atomic resources to cause a denial of service.

1515) Improper input validation (CVE-ID: CVE-2026-80865)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an invalid user-space pointer to be accessed.

The vulnerability exists due to improper input validation in the copy_user_syms function when processing a user-space pointer array. A local user can provide a user-space pointer array without prior range validation to cause an invalid user-space pointer to be accessed.

1516) Improper access control (CVE-ID: CVE-2026-80867)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to conduct DMA attacks.

The vulnerability exists due to improper access control in the Alpha-specific pci_mmap_resource() function when mapping PCI BARs while kernel lockdown is enabled. A local user can map a PCI BAR to conduct DMA attacks.

1517) Improper input validation (CVE-ID: CVE-2026-80870)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the KFD CRIU restore functions when processing user-supplied CRIU restore data. A local user can supply a restored event or buffer object ID larger than INT_MAX to cause a denial of service.

The denial of service requires panic_on_warn to be enabled.

1518) Incorrect calculation (CVE-ID: CVE-2026-80875)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incorrect TCP state handling.

The vulnerability exists due to an incorrect transport-header offset calculation in the IPVS TCP state lookup when processing IPv6 packets with extension headers. A remote attacker can send a crafted IPv6 packet with extension headers to cause incorrect TCP state handling.

1519) Incorrect calculation (CVE-ID: CVE-2026-80876)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect ring-buffer event data length reporting.

The vulnerability exists due to an improper length calculation in ring_buffer_event_length() when handling small ring-buffer events on architectures with forced 8-byte alignment. A local user can trigger processing of small ring-buffer events to cause incorrect ring-buffer event data length reporting.

The issue was observed on a riscv64 kernel with CONFIG_HAVE_64BIT_ALIGNED_ACCESS enabled.

1520) Memory leak (CVE-ID: CVE-2026-80877)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to improper resource management in afs_update_cell() when processing a cell update with an empty server list. A local user can trigger processing of an empty server list during a cell update to cause a memory leak.

1521) Memory leak (CVE-ID: CVE-2026-80878)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to improper resource management in afs_lookup_volume_rcu() when looking up a volume through RCU and acquiring a reference to a dying volume fails. A local user can trigger a volume lookup that encounters this condition to cause a memory leak.

1522) Deadlock (CVE-ID: CVE-2026-80879)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a circular locking dependency in ocfs2_dio_end_io_write when completing direct I/O writes involving unwritten extents and orphan cleanup. A local user can perform filesystem operations that trigger conflicting lock acquisition to cause a denial of service.

1523) Race condition (CVE-ID: CVE-2026-80880)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a race condition.

The vulnerability exists due to a race condition in implicit ODP memory region re-registration when reregistering an implicit ODP memory region without specifying a translation. A local user can reregister an implicit ODP memory region to trigger a race condition.

The race involves implicit child mkeys accessing the memory region's protection domain.

1524) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-80881)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause OCFS2 to process metadata that previously failed validation.

The vulnerability exists due to improper handling of validation failures in ocfs2_read_blocks() when reusing buffer heads returned by sb_getblk(). A local user can trigger reuse of buffer heads retaining BH_Uptodate status after failed validation to cause OCFS2 to process metadata that previously failed validation.

1525) Race condition (CVE-ID: CVE-2026-80883)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to submit a job before the address register map is initialized.

The vulnerability exists due to a race condition in the Tegra GR2D and GR3D drivers when submitting a job after the HOST1X client becomes available to userspace and before initialization completes. A local user can submit a job during this initialization window to submit a job before the address register map is initialized.

1526) Race condition (CVE-ID: CVE-2026-80886)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the MSM serial driver console UART when userspace writes to the TTY device concurrently with kernel console output. A local user can write to the TTY device while the kernel printk path reconfigures the UART controller to cause a denial of service.

The issue is most likely to occur during system startup or shutdown.

1527) Integer overflow (CVE-ID: CVE-2026-80887)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass shader window bounds validation.

The vulnerability exists due to an integer overflow in vmw_shader_define() when processing user-supplied shader size and offset values. A local user can provide a crafted shader size and offset to bypass shader window bounds validation.

The unchecked offset is forwarded to host SVGA shader-create commands.

1528) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-80888)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource release in ttm_prime_fd_to_handle() in the vmwgfx DRM driver when importing a non-vmwgfx PRIME file descriptor through the DRM_VMW_GB_SURFACE_REF or DRM_VMW_GB_SURFACE_REF_EXT path. A local user can pass a non-vmwgfx PRIME file descriptor to cause a denial of service.

1529) Insufficient Session Expiration (CVE-ID: CVE-2026-80890)

CWE-ID: CWE-613 - Insufficient Session Expiration

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to restart an SCTP association.

The vulnerability exists due to improper validation of cookie expiration in sctp_unpack_cookie() when processing an expired State Cookie for an existing association with mismatched Verification Tags. A remote attacker can replay an expired State Cookie with mismatched Verification Tags to restart an SCTP association.

1530) Improper input validation (CVE-ID: CVE-2026-80891)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause unsafe pinning of guest pages.

The vulnerability exists due to improper input validation in the KVM s390 PCI adapter-interrupt facility handling when enabling the facility with crafted AIBV or AISB values. A local user can supply an AIBV that spans more than one page or a misaligned AISB address to cause unsafe pinning of guest pages.

The AISB is used when the summary-bit indicator is specified.

1531) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-80892)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource allocation limits in the EROFS LZMA decompression stream pool when mounting an EROFS image. A local user can mount an EROFS image containing LZMA dictionaries to cause a denial of service.

Each LZMA stream can preallocate an image-supplied dictionary of up to 8 MiB.

1532) Incorrect calculation (CVE-ID: CVE-2026-80893)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt swap entry data.

The vulnerability exists due to improper handling of userfaultfd write-protection bits in copy_hugetlb_page_range() in mm/hugetlb.c when forking a process while a hugetlb migration entry is in flight or a hugetlb page is poisoned. A local user can fork a process under these conditions to corrupt swap entry data.

Userfaultfd does not need to be involved.

1533) Improper input validation (CVE-ID: CVE-2026-80901)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause IPVS to process ICMP messages with invalid checksums.

The vulnerability exists due to improper checksum validation in IPVS ICMP and ICMPv6 handling when processing ICMP messages. A remote attacker can send an ICMP message with an invalid checksum to cause IPVS to process ICMP messages with invalid checksums.

The issue includes ICMPv6 packets from clients and ICMPv6 responses from real servers when checksum validation is not performed by hardware.

1534) Memory leak (CVE-ID: CVE-2026-80902)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to improper reclamation of active descriptors in the sun6i DMA driver's DMA termination handling when terminating DMA transfers. A local user can terminate DMA transfers to cause a memory leak.

Non-cyclic descriptors and their linked-list item chains are affected.

1535) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-80904)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass TLS record authentication.

The vulnerability exists due to improper handling of cryptographic decryption errors in tls_sw_splice_read() when reading TLS records through splice. A remote attacker can cause a TLS record that failed authentication to be delivered through splice to bypass TLS record authentication.

1536) Incorrect behavior order (CVE-ID: CVE-2026-80906)

CWE-ID: CWE-696 - Incorrect Behavior Order

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incorrect transport header handling.

The vulnerability exists due to incorrect behavior order in packet_parse_headers() when processing a VLAN-tagged frame. A remote attacker can send a VLAN-tagged frame to cause incorrect transport header handling.

1537) Incorrect Calculation of Buffer Size (CVE-ID: CVE-2026-80907)

CWE-ID: CWE-131 - Incorrect Calculation of Buffer Size

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an incorrect calculation of the decoded picture buffer minimum size in the amdgpu UVD H.264 decode message handler when processing H.264 decode messages. A local user can submit a crafted H.264 decode message to cause a denial of service.

1538) Integer overflow (CVE-ID: CVE-2026-80908)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an integer overflow in DPB size calculations.

The vulnerability exists due to integer overflow in the amdgpu UVD message decoder when processing a UVD message with dimensions exceeding 4096. A local user can submit a UVD message with oversized dimensions to trigger an integer overflow in DPB size calculations.

1539) Integer overflow (CVE-ID: CVE-2026-80909)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an integer overflow during minimum DPB size calculation.

The vulnerability exists due to improper validation of the H.265 reference count in the AMDGPU UVD message decoder when decoding UVD messages. A local user can submit a UVD message with an invalid number of H.265 references to cause an integer overflow during minimum DPB size calculation.

1540) Type Confusion (CVE-ID: CVE-2026-80910)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access of an enumerated control value through an integer union member in the lpass-wsa-macro codec driver when reading affected enumerated controls. A local user can read an affected control to cause a denial of service.

The issue occurs on 64-bit kernels with CONFIG_SND_CTL_DEBUG enabled.

1541) Improper handling of exceptional conditions (CVE-ID: CVE-2026-80911)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect widget reference-count handling.

The vulnerability exists due to improper handling of exceptional conditions in sof_widget_setup_unlocked() when handling failures during widget setup. A local user can trigger a widget setup failure to cause incorrect widget reference-count handling.

1542) NULL pointer dereference (CVE-ID: CVE-2026-80912)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in security_get_classes() when processing an SELinux policy with an unclaimed class value. A local user can provide a policy with sparse class values to cause a denial of service.

1543) NULL pointer dereference (CVE-ID: CVE-2026-80913)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the SELinux boolean value mapping array when processing a policy image that declares undefined boolean values. A local privileged user can load a crafted SELinux policy to cause a denial of service.

1544) Use-after-free (CVE-ID: CVE-2026-80914)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to use-after-free in the Bluetooth ISO iso_conn_ready function when handling a concurrently closed BIS listener socket. A local user can close a BIS listener socket concurrently with connection readiness processing to trigger a use-after-free.

1545) Memory corruption (CVE-ID: CVE-2026-80916)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of allocation failure in KCOV initialization and remote-start handling when remote KCOV collection is initiated after initialization buffer allocation fails. A local user can invoke remote KCOV collection from a non-task context to cause a denial of service.

Out-of-bounds access requires the configured remote coverage size to be smaller than CONFIG_KCOV_IRQ_AREA_SIZE.

1546) Race condition (CVE-ID: CVE-2026-80916)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause data corruption.

The vulnerability exists due to a race condition in the KCOV remote coverage state handling when nested softirq preemption occurs during remote KCOV collection. A local user can trigger nested softirq preemption during remote KCOV collection to cause data corruption.

The issue affects PREEMPT_RT kernels.

1547) NULL pointer dereference (CVE-ID: CVE-2026-80917)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the generic PCI host CAM operations when enumerating PCI buses on 32-bit CAM systems. A local user can trigger PCI configuration-space access during bus enumeration to cause a denial of service.

Only 32-bit hosts using the "pci-host-cam-generic" compatible are affected.

1548) Type Confusion (CVE-ID: CVE-2026-80918)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose kernel pointer information.

The vulnerability exists due to type confusion in item_udata() and item_sdata() in the HID core when processing long-format HID descriptor items. An attacker with physical access can connect a HID device containing a crafted long-format report size item to disclose kernel pointer information.

The issue affects hid_scan_report(); hid_parse_collections() stops processing when it encounters a long item.

1549) Improper access control (CVE-ID: CVE-2026-80921)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access a device that is no longer available.

The vulnerability exists due to improper access control in KVM s390 VSIE APCB shadowing when shadowing crypto access bits from a format 0 APCB. A local user can use stale crypto access bits to access a device that is no longer available.

The issue affects nested guest environments.

1550) Insufficient Entropy (CVE-ID: CVE-2026-80922)

CWE-ID: CWE-331 - Insufficient Entropy

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to distinguish generated output from uniformly random data.

The vulnerability exists due to insufficient entropy in the Qualcomm RNG driver when generating random data. A local user can request random data to distinguish generated output from uniformly random data.

1551) Use-after-free (CVE-ID: CVE-2026-80923)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger a use-after-free.

The vulnerability exists due to a dangling pointer in the xHCI debug tty driver when tty driver registration fails and the module is subsequently unloaded. A local privileged user can unload the module after a tty driver registration failure to trigger a use-after-free.

1552) Race condition (CVE-ID: CVE-2026-80925)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in VLAN device feature transfer handling when toggling hardware VLAN transmit offload. A local user can toggle hardware VLAN transmit offload during transmit processing to cause a denial of service.

1553) Use-after-free (CVE-ID: CVE-2026-80928)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free of struct cred.

The vulnerability exists due to a use-after-free in smack_file_send_sigiotask() when accessing the credentials of another task during signal delivery. A local user can trigger the affected credential access during a concurrent credential change to trigger a use-after-free of struct cred.

1554) Improper handling of exceptional conditions (CVE-ID: CVE-2026-80930)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an IRQ enable/disable imbalance.

The vulnerability exists due to improper handling of exceptional conditions in the TPM I2C Nuvoton driver's i2c_nuvoton_wait_for_stat() function when waiting for a TPM status interrupt times out or is interrupted. A local user can cause a wait to time out or be interrupted to cause an IRQ enable/disable imbalance.

1555) Out-of-bounds write (CVE-ID: CVE-2026-80931)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause an out-of-bounds write.

The vulnerability exists due to improper bounds checking in w1_f19_i2c_master_transfer() in the DS28E17 1-Wire-to-I2C bridge driver when handling an I2C_M_RECV_LEN read with an oversized device-controlled length. An attacker with physical access can supply an oversized length byte through a downstream I2C device to cause an out-of-bounds write.

1556) Use-after-free (CVE-ID: CVE-2026-80932)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to improper workqueue synchronization in virtio_vsock_remove() when removing a virtio vsock device. A local user can trigger device removal while dependent work items are queued to cause a use-after-free condition.

The race involves tx_work, send_pkt_work, and rx_work.

1557) Out-of-bounds read (CVE-ID: CVE-2026-80933)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read beyond the firmware buffer.

The vulnerability exists due to an out-of-bounds read in the mt7996 EEPROM default firmware handling when parsing a truncated default EEPROM firmware. A local user can provide a truncated default EEPROM firmware to read beyond the firmware buffer.

1558) Out-of-bounds write (CVE-ID: CVE-2026-80935)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in mt7996_mcu_get_eeprom() when processing an EEPROM response from a device. An attacker with physical access can report an arbitrary EEPROM address to cause memory corruption.

1559) Out-of-bounds write (CVE-ID: CVE-2026-80937)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in mt7915_mcu_get_eeprom() when processing a device-controlled MCU EEPROM response. An attacker with physical access can provide a response containing an arbitrary address to cause memory corruption.

1560) Deadlock (CVE-ID: CVE-2026-80938)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock in mt7615_suspend() when synchronously canceling mac_work while holding the mt76 mutex. A local user can initiate system suspend while mac_work is running to cause a denial of service.

1561) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-80939)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in the rtw89 PCI driver's rfkill polling handler when the system performs a warm reboot. A local privileged user can initiate a warm reboot to cause a denial of service.

The issue occurs on arm64 platforms after the PCIe link has been torn down.

1562) Memory leak (CVE-ID: CVE-2026-80941)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to failure to free memory in rtw_txq_push_skb() when handling a failed HCI transmission. A local user can trigger the transmission path during an HCI write failure to cause a denial of service.

1563) Expired pointer dereference (CVE-ID: CVE-2026-80944)

CWE-ID: CWE-825 - Expired pointer dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an expired pointer dereference in the mwifiex synchronous command response handler when a synchronous command wait is interrupted before a late firmware response is processed. A local user can interrupt a synchronous command wait to cause a denial of service.

The issue was observed during repeated association and disassociation cycles.

1564) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-80945)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt decompression results.

The vulnerability exists due to improper DMA mapping lifecycle management in the Intel IAA decompression fallback when processing a software fallback after a hardware analytics error. A local user can trigger the software fallback before the destination buffer is unmapped to corrupt decompression results.

Corruption occurs when SWIOTLB is active and a stale bounce buffer is copied during DMA unmapping.

1565) Use-after-free (CVE-ID: CVE-2026-80947)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to trigger a use-after-free.

The vulnerability exists due to a use-after-free in the rtl8xxxu RX URB workqueue teardown when a device is disconnected during active receive traffic. An attacker with physical access can disconnect the device during active receive traffic to trigger a use-after-free.

1566) Memory leak (CVE-ID: CVE-2026-80949)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to missing release of memory in brcmf_sdio_read_control() when handling error paths during control-frame reads. A local user can trigger the affected error paths to cause a denial of service.

1567) Out-of-bounds write (CVE-ID: CVE-2026-80951)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to write beyond the bounds of the IBI pool.

The vulnerability exists due to improper bounds checking in svc_i3c_master_handle_ibi() when processing in-band interrupt payloads from an I3C device. An attacker with physical access can send an IBI payload larger than the requested maximum payload length to write beyond the bounds of the IBI pool.

1568) Use-after-free (CVE-ID: CVE-2026-80952)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose kernel stack contents and cause a use-after-free.

The vulnerability exists due to improper device descriptor lifetime management in i3c_master_unregister_i3c_devs() when unregistering I3C devices. A local user can trigger device unregistration while a modalias is generated to disclose kernel stack contents and cause a use-after-free.

A racing modalias operation can observe a NULL device descriptor and use an uninitialized stack i3c_device_info structure.

1569) NULL pointer dereference (CVE-ID: CVE-2026-80963)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the dm-stat_free cleanup function when freeing dm-stats data after per-cpu data allocation fails. A local user can trigger a failed per-cpu data allocation to cause a denial of service.

1570) Out-of-bounds read (CVE-ID: CVE-2026-80964)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in the ALSA virmidi driver probe function when manually binding a device through the sysfs interface with an invalid card index. A local user can manually bind a device with an invalid card index to perform an out-of-bounds read.

1571) Improper Validation of Array Index (CVE-ID: CVE-2026-80965)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds access.

The vulnerability exists due to improper validation of a card index in the ALSA serial-u16550 driver's snd_serial_probe function when manually binding a device through the sysfs interface. A local user can bind a device with an invalid card index to cause an out-of-bounds access.

1572) Improper Validation of Array Index (CVE-ID: CVE-2026-80966)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds access.

The vulnerability exists due to improper validation of an array index in the ALSA portman2x4 driver when binding the driver through sysfs with a negative card index. A local user can supply a negative card index to perform an out-of-bounds access.

1573) Improper initialization (CVE-ID: CVE-2026-80967)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization of mutexes in the pcxhr_probe() function when handling an early interrupt during device probe. A local user can trigger an early interrupt during device probe to cause a denial of service.

1574) Improper Validation of Array Index (CVE-ID: CVE-2026-80968)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds access.

The vulnerability exists due to improper validation of an array index in the ALSA mts64 driver's snd_mts64_probe function when binding a device through sysfs with a negative card index. A local user can provide a negative card index to cause an out-of-bounds access.

1575) Improper Validation of Array Index (CVE-ID: CVE-2026-80969)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds memory access.

The vulnerability exists due to improper validation of an array index in the ALSA mpu401 driver probe routine when manually binding a device through the sysfs interface with an invalid card index. A local user can set an invalid card index to cause an out-of-bounds memory access.

1576) Use-after-free (CVE-ID: CVE-2026-80971)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 1 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a use-after-free condition.

The vulnerability exists due to use-after-free in the ALSA bcd2000 driver's URB handling when a BCD2000 USB device is disconnected while a rawmidi substream remains open. An attacker with physical access can disconnect the device while the substream remains open to cause a use-after-free condition.

1577) Improper Validation of Array Index (CVE-ID: CVE-2026-80972)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds memory access.

The vulnerability exists due to improper validation of a card index in the ALSA aloop driver's loopback_probe function when manually binding a device through the sysfs interface. A local user can provide an invalid card index to perform an out-of-bounds memory access.

1578) Out-of-bounds read (CVE-ID: CVE-2026-80973)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose kernel memory.

The vulnerability exists due to an out-of-bounds read in usb6fire_comm_receiver_handler() when processing MIDI events from a connected USB device. An attacker with physical access can provide a MIDI event with an excessive length value to disclose kernel memory.

The receiver is submitted during device probing, and forwarding data through the rawmidi read path requires an open MIDI input substream.

1579) Memory leak (CVE-ID: CVE-2026-80974)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to improper resource management in the SM501 driver remove functions when removing an SM501 device. A local user can trigger removal of an SM501 device to cause a memory leak.

1580) Out-of-bounds read (CVE-ID: CVE-2026-80976)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read.

The vulnerability exists due to stale IPv6 control block state in the decap_and_validate() function of the seg6 local processing component when processing a decapsulated IPv6 packet through an End.DX6 or End.DT6 route. A local user can install a local SID and inject a crafted outer IPv6 packet to cause an out-of-bounds read.

The outer packet contains Hop-by-Hop and Destination Options headers followed by an SRH and a minimal inner IPv6 packet.

1581) Use-after-free (CVE-ID: CVE-2026-80977)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory.

The vulnerability exists due to improper handling of shared zerocopy state in skb_tx_error() when processing cloned socket buffers. A remote attacker can trigger processing of cloned socket buffers to corrupt memory.

The issue can be reached when Open vSwitch processes a non-last OVS_ACTION_ATTR_RECIRC action, the clone encounters a flow miss, and a later local ESP delivery decrypts data in place.

1582) Integer overflow (CVE-ID: CVE-2026-80978)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause skb header offsets to wrap.

The vulnerability exists due to an integer overflow in IP tunnel device headroom configuration when configuring a stack of user-created IP tunnel devices. A local user can create a stacked tunnel-device configuration with excessive headroom to cause skb header offsets to wrap.

The affected skb header offsets use a 16-bit representation.

1583) Use-after-free (CVE-ID: CVE-2026-80979)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the SMC connection teardown handling for DMB-nocopy buffers when a receive tasklet is re-armed after a connection is freed. A remote attacker can cause the receive tasklet to access a freed send buffer to cause a denial of service.

Only SMCD links supporting DMB-nocopy are affected.

1584) Race condition (CVE-ID: CVE-2026-80980)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause connection state inconsistencies.

The vulnerability exists due to a race condition in the connection state flags of struct smc_connection when processing received connection control messages concurrently with connection termination. A remote attacker can send connection control messages during concurrent connection termination to cause connection state inconsistencies.

1585) Use-after-free (CVE-ID: CVE-2026-80982)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in smc_rx_pipe_buf_release() when releasing pipe buffers concurrently with connection closure. A local user can cause a pipe buffer release to race with connection cleanup to trigger a use-after-free condition.

1586) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-80983)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in smc_switch_conns() when handling connection switches during SMC link failover. A local user can initiate a connection switch during link failover to cause a denial of service.

The target link must go down or the connection must be killed while the switch is in progress.

1587) NULL pointer dereference (CVE-ID: CVE-2026-80984)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the SMC-D teardown path when an SMC-D link group terminates while a socket is waiting during teardown. A local user can trigger the teardown race to cause a denial of service.

1588) Memory leak (CVE-ID: CVE-2026-80987)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak memory.

The vulnerability exists due to improper error handling in the NTB transport transmit queue when submitting an oversized transmit buffer. A local user can submit an oversized transmit buffer to leak memory.

1589) Memory leak (CVE-ID: CVE-2026-80988)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in ntb_transport_tx_enqueue() when transmitting packets while the QP link is down. A local user can submit packets during the link-down condition to cause a denial of service.

1590) Incomplete Internal State Distinction (CVE-ID: CVE-2026-80989)

CWE-ID: CWE-372 - Incomplete Internal State Distinction

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper connection state management in tbnet_connected_work() when handling a failed connection setup followed by connection teardown. A remote attacker can trigger a failed connection setup followed by connection teardown to cause a denial of service.

When panic_on_warn is enabled, stopping already stopped rings can be fatal.

1591) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-80990)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 1 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper resource release in tbnet_connected_work() when handling an Rx HopID allocation mismatch during an XDomain connection. An attacker with physical access can trigger an Rx HopID allocation mismatch to cause a denial of service.

1592) Use-after-free (CVE-ID: CVE-2026-80991)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to a race condition in ravb_ptp_interrupt() and ravb_ptp_stop() when PTP interrupt handling occurs during PTP clock teardown. A local user can trigger the race to cause a use-after-free.

1593) NULL pointer dereference (CVE-ID: CVE-2026-80992)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the Renesas RAVB driver's PTP clock handling when querying hardware timestamping information before a PTP clock is registered or after PTP clock registration fails. A local user can query the PTP clock index to cause a denial of service.

1594) Use-after-free (CVE-ID: CVE-2026-80994)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Open vSwitch flow deletion handling code when processing flow deletion commands. A local user can issue a flow deletion command during a race window to cause a denial of service.

1595) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-80996)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause live L2TP objects to accumulate.

The vulnerability exists due to improper error handling in the L2TP netlink tunnel and session create and modify handlers when multicast notification delivery fails after a live operation completes. A local user can issue L2TP netlink create or modify commands that are erroneously reported as failed to cause live L2TP objects to accumulate.

1596) Reliance on undefined behavior (CVE-ID: CVE-2026-80999)

CWE-ID: CWE-758 - Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger a kernel warning.

The vulnerability exists due to improper GPIO API selection in the rtl83xx_reset_assert() and rtl83xx_reset_deassert() helpers when handling reset GPIOs controlled by sleeping controllers. A local privileged user can trigger device probing with such a GPIO configuration to trigger a kernel warning.

1597) Integer underflow (CVE-ID: CVE-2026-81000)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write packet data outside allocated memory.

The vulnerability exists due to an integer underflow in TUN and TAP interface handling in tun_get_user() when processing an oversized headroom request propagated by an OVS port. A local user can configure an OVS port to propagate an oversized headroom request to a TUN or TAP device to write packet data outside allocated memory.

1598) Use-after-free (CVE-ID: CVE-2026-81001)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in sl_sync() in the SLIP driver when opening a SLIP line discipline concurrently with SLIP device teardown. A local user can trigger a race between SLIP device opening and teardown to cause a denial of service.

1599) Out-of-bounds write (CVE-ID: CVE-2026-81002)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in xdp_convert_zc_to_xdp_frame() when processing an AF_XDP zero-copy packet redirected through cpumap. A local user can submit a crafted AF_XDP zero-copy packet to cause a denial of service.

1600) Improper access control (CVE-ID: CVE-2026-81003)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to inject data into existing AF_IUCV sockets and cause a denial of service.

The vulnerability exists due to improper ingress device validation in afiucv_hs_rcv() socket selection when processing a raw ETH_P_AF_IUCV frame received on a network device. A local user can send a crafted raw ETH_P_AF_IUCV frame through its loopback device to inject data into existing AF_IUCV sockets and cause a denial of service.

Exploitation requires CAP_NET_RAW in an unprivileged user and network namespace.

1601) NULL pointer dereference (CVE-ID: CVE-2026-81005)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper shutdown state management in the IPMI message handler failed-registration rollback path when asynchronous redo_bmc_reg work retries BMC device-ID probing after a failed registration. A local user can cause BMC device-ID retrieval to fail and trigger a NULL pointer dereference to cause a denial of service.

The issue occurs after the lower driver's shutdown callback has cleared the SI state machine data.

1602) Use of Uninitialized Variable (CVE-ID: CVE-2026-81007)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized stack memory.

The vulnerability exists due to improper length validation in the ipmb_write() function when writing a zero or short IPMB message. A local user can write a zero or short IPMB message to disclose uninitialized stack memory.

1603) Use-after-free (CVE-ID: CVE-2026-81008)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to use-after-free in icc_get() and of_icc_get_by_index() when handling a failed dynamic allocation of a path name. A local user can invoke subsequent interconnect path operations to cause memory corruption.

1604) Out-of-bounds read (CVE-ID: CVE-2026-81011)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the hp-bioscfg package parsers when parsing ACPI BIOS configuration attribute packages. A local user can cause the kernel to parse a short package whose name length exceeds its element count to disclose sensitive information.

The condition requires acceptance of packages that are shorter than the element count expected for their attribute type.

1605) Off-by-one (CVE-ID: CVE-2026-81012)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds write.

The vulnerability exists due to an off-by-one error in hp_get_string_from_buffer() in the hp-bioscfg driver when converting a string whose length equals the destination buffer size. A local user can cause the function to process such a string to perform an out-of-bounds write.

1606) Out-of-bounds read (CVE-ID: CVE-2026-81013)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in validate_password_input() in the hp-bioscfg password attribute handling when writing an empty string to current_password or new_password. A local user can write an empty string to a password attribute to disclose sensitive information.

1607) Out-of-bounds read (CVE-ID: CVE-2026-81014)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in the sk_store() and kek_store() functions of the hp-bioscfg driver when handling sysfs writes ending with a trailing newline. A local user can submit a sysfs write with a trailing newline to perform an out-of-bounds read.

1608) Unchecked Return Value (CVE-ID: CVE-2026-81016)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an ioremap-on-RAM warning.

The vulnerability exists due to unchecked return values in amd_stb_s2d_init() when handling S2D SMU physical-address queries. A local user can cause physical address zero to be passed to devm_ioremap() to trigger an ioremap-on-RAM warning.

The condition is associated with the spill-to-DRAM feature's separate SMU message port.

1609) Out-of-bounds write (CVE-ID: CVE-2026-81017)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read from and write to memory out of bounds.

The vulnerability exists due to improper bounds checking in cros_ec_sensorhub_ring_handler() when processing EC-reported FIFO events. A local user can trigger processing of an EC FIFO event containing an out-of-range sensor number to read from and write to memory out of bounds.

1610) Memory leak (CVE-ID: CVE-2026-89437)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in the sar_probe() function when handling device mode information allocated by parse_package(). A local user can trigger an error path in sar_probe() to cause a denial of service.

1611) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-89438)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access unintended MMIO offsets.

The vulnerability exists due to improper validation of CLOS IDs and logical CPU IDs in the ISST core power feature when handling user-supplied CLOS parameter and association commands. A local user can supply out-of-range CLOS IDs or logical CPU IDs to access unintended MMIO offsets.

1612) NULL pointer dereference (CVE-ID: CVE-2026-89439)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the isst_if_get_tpmi_instance_count function in the ISST TPMI core when handling a TPMI instance-count request for a socket whose instance failed to load. A local user can request an instance count for a socket whose instance failed to load to cause a denial of service.

1613) Use-after-free (CVE-ID: CVE-2026-89440)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the via-sdmmc card-detect interrupt handler and carddet_work when handling a card-detect interrupt after mmc_add_host() fails. A local user can trigger card-detect interrupt handling against a freed host object to cause a denial of service.

1614) Use-after-free (CVE-ID: CVE-2026-89441)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a use-after-free condition.

The vulnerability exists due to a use-after-free in carddet_work in the VIA SD/MMC driver when queued card-detect work executes after driver removal. A local privileged user can trigger device removal while card-detect work is pending to cause a use-after-free condition.

1615) NULL pointer dereference (CVE-ID: CVE-2026-89442)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the isst_if_clos_assoc ioctl handler when processing a socket ID for an in-range package without a bound TPMI SST instance. A local user can submit a crafted clos_assoc ioctl request to cause a denial of service.

1616) Out-of-bounds read (CVE-ID: CVE-2026-89442)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the isst_if_clos_assoc ioctl handler when processing a user-supplied socket ID equal to topology_max_packages(). A local user can submit a crafted clos_assoc ioctl request to cause a denial of service.

1617) Out-of-bounds read (CVE-ID: CVE-2026-89443)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform out-of-bounds reads.

The vulnerability exists due to an out-of-bounds read in the ISST perf mask ioctl handlers when processing user-supplied ioctl input containing an invalid performance level. A local user can submit a crafted ioctl request with an invalid level value to perform out-of-bounds reads.

1618) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-89444)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into log files in the dell-wmi-sysman set_attribute() function when setting BIOS attributes. A local user can cause a BIOS attribute request buffer containing a plaintext administrator password to be logged to disclose sensitive information.

1619) Configuration (CVE-ID: CVE-2026-89448)

CWE-ID: CWE-16 - Configuration

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause access control services to remain disabled while the IOMMU is forced on.

The vulnerability exists due to improper configuration handling in detect_intel_iommu() when tboot forces the IOMMU on after ACS was not requested. A local privileged user can configure the system to disable ACS to cause access control services to remain disabled while the IOMMU is forced on.

1620) Race condition (CVE-ID: CVE-2026-89451)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in iommu SVA handle initialization when concurrently binding and unbinding an SVA device. A local user can race SVA device binding and unbinding operations to cause a denial of service.

1621) Use-after-free (CVE-ID: CVE-2026-89452)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in msm_iommu_probe() in the MSM IOMMU driver when IOMMU device sysfs setup or registration fails. A local user can trigger a failed probe to leave a dangling entry in qcom_iommu_devices to cause a denial of service.

A later traversal of qcom_iommu_devices is required to dereference the dangling list entry.

1622) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-89456)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to receive zeroed data for unread portions of a request.

The vulnerability exists due to improper handling of partial-completion length in dasd_default_erp_postaction() when recovering a partially completed ESE read through the ERP chain. A local user can issue a read request that is partially completed and recovered through the ERP chain to receive zeroed data for unread portions of a request.

1623) NULL pointer dereference (CVE-ID: CVE-2026-89457)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in s390 DASD sysfs discipline callbacks when reading world-readable sysfs attributes during device initialization. A local user can read a sysfs attribute before private device data is allocated to trigger a kernel panic and cause a denial of service.

1624) Unchecked Return Value (CVE-ID: CVE-2026-89458)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an unchecked return value in dasd_int_handler when handling an NRF read of an unallocated ESE track. A local user can trigger a failed ESE read that is completed successfully to disclose sensitive information.

A failed sense-data parse or a current track outside the requested range can leave destination pages untouched.

1625) NULL pointer dereference (CVE-ID: CVE-2026-89460)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the s390 CPUMF performance monitoring unit when a CPU is added while a per-task CPUMF performance event is running. A local privileged user can trigger CPU hotplug during execution of a per-task performance event to cause a denial of service.

1626) Race condition (CVE-ID: CVE-2026-89461)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause the polling callback to continue accessing the fuel gauge after system suspend.

The vulnerability exists due to improper synchronization in the max17040 fuel-gauge driver's suspend handler when system suspend races with the polling callback. A remote attacker can cause system suspend to race with the polling callback to cause the polling callback to continue accessing the fuel gauge after system suspend.

The polling work requeues itself after each poll.

1627) Unchecked Return Value (CVE-ID: CVE-2026-89462)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause power-supply properties to report incorrect voltage or state-of-charge values.

The vulnerability exists due to improper error handling in the max17040 power supply driver when an I2C register read fails. A local user can access power-supply properties during a failed I2C register read to cause power-supply properties to report incorrect voltage or state-of-charge values.

A polling worker may replace the cached state of charge with an invalid value and emit a spurious change event.

1628) Use-after-free (CVE-ID: CVE-2026-89463)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to use-after-free in the ucs1002 health_poll delayed work when unbinding the ucs1002 driver while health polling work is queued. A local privileged user can cause the driver to be unbound while health polling work is queued to cause a denial of service.

The delayed work can reschedule itself while the chip reports a bad-health condition.

1629) Use-after-free (CVE-ID: CVE-2026-89464)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to use-after-free in the twl4030_charger driver's bci work handlers when removing the device while a worker is pending. A local user can trigger device removal while a worker is pending to cause a use-after-free condition.

The USB transceiver notifier can reschedule work after device removal returns.

1630) Use-after-free (CVE-ID: CVE-2026-89465)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access freed rt9455_info memory.

The vulnerability exists due to improper delayed-work cancellation in RT9455 charger driver teardown handling when delayed work is pending during device removal or probe error cleanup. A local user can race delayed work with teardown to access freed rt9455_info memory.

The threaded IRQ handler can queue delayed work, and batt_presence_work can requeue itself or queue max_charging_time_work.

1631) Improper Null Termination (CVE-ID: CVE-2026-89466)

CWE-ID: CWE-170 - Improper Null Termination

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper null termination in qcom_battmgr_sc8280xp_strcpy() when copying non-Pascal-style strings from firmware. A local user can read exposed power supply properties containing a full-length firmware string to disclose sensitive information.

The affected fields are model_number, serial_number, and oem_info.

1632) Use-after-free (CVE-ID: CVE-2026-89467)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to a use-after-free in the qcom_battmgr enable_work worker when the PMIC GLINK service comes up after battmgr has been freed. A local user can cause a PDR notification to queue enable_work after battmgr is freed to trigger a use-after-free.

1633) Use-after-free (CVE-ID: CVE-2026-89468)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to a use-after-free in the lp8788 charger driver's removal handler when an IRQ thread queues charger_work during device removal. A local user can race IRQ handling with device removal to cause a use-after-free condition.

1634) Use-after-free (CVE-ID: CVE-2026-89469)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to improper synchronization in lp8727_release_irq() when the IRQ handler queues delayed work during IRQ release. A local user can trigger a race between IRQ handling and IRQ release to cause a use-after-free condition.

1635) Out-of-bounds write (CVE-ID: CVE-2026-89470)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in the cros_usbpd-charger driver probe when processing a raw charger port count returned by the embedded controller. An attacker with physical access can cause the embedded controller to report an inaccurate port count to cause memory corruption.

The embedded controller can report a port count of up to 255.

1636) Out-of-bounds write (CVE-ID: CVE-2026-89471)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to corrupt kernel memory.

The vulnerability exists due to an out-of-bounds write in cros_usbpd_charger_probe() in the cros_usbpd-charger driver when processing EC-reported USB PD and charger port counts. A local privileged user can cause a compromised EC to report port counts exceeding the fixed ports[] array capacity to corrupt kernel memory.

The ports[] array contains eight entries.

1637) Use-after-free (CVE-ID: CVE-2026-89472)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in charger-manager regulator handle management when handling a concurrent write to the externally_control sysfs attribute during device teardown. A local user can write to the externally_control sysfs attribute while charging is enabled to trigger a use-after-free condition.

The sysfs attribute can also be exposed before regulator acquisition completes during probing.

1638) Memory leak (CVE-ID: CVE-2026-89473)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak a power_supply reference.

The vulnerability exists due to improper resource lifecycle management in bq25890_fw_probe() when handling secondary charger references during probe failures or driver detach. A local user can trigger a later probe failure or driver detachment to leak a power_supply reference.

1639) Use-after-free (CVE-ID: CVE-2026-89474)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the bq256xx charger driver's usb_work handler when queued usb_work executes during device cleanup. A local user can trigger device cleanup while usb_work is queued to cause a denial of service.

1640) Use-after-free (CVE-ID: CVE-2026-89475)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the bq24257 charger driver when device removal races with the STAT-pin interrupt handler. A local user can cause the interrupt handler to reschedule delayed work during device removal to cause a denial of service.

The issue applies when input-current-limit autosetting is enabled.

1641) Integer underflow (CVE-ID: CVE-2026-89476)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an integer underflow.

The vulnerability exists due to improper tracking of outstanding stream reconfiguration request parameters in SCTP stream reconfiguration response handling when processing duplicate RECONF responses. A remote attacker can send duplicate RECONF responses to cause an integer underflow.

A cached RECONF chunk containing multiple request parameters must have another parameter still outstanding.

1642) NULL pointer dereference (CVE-ID: CVE-2026-89477)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in SCTP stream reconfiguration request handling when processing specially crafted SCTP RECONF chunks. A remote attacker can send a specially crafted SCTP RECONF packet to cause a denial of service.

A RECONF chunk containing incoming SSN reset, outgoing SSN reset, and response parameters, or two RECONF chunks in one packet, can trigger the issue.

1643) Use-after-free (CVE-ID: CVE-2026-89478)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to access freed memory.

The vulnerability exists due to a use-after-free in the SCTP input queue when processing a DATA chunk after an authenticated ASCONF DEL-IP removes its transport. A remote user can cause a delayed SACK to read the freed transport's state to access freed memory.

1644) Use-after-free (CVE-ID: CVE-2026-89479)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to access freed memory.

The vulnerability exists due to use-after-free in the SCTP endpoint receive loop when processing a specially crafted SCTP packet containing bundled chunks. A remote attacker can send an SCTP packet that deletes an association before subsequent chunks are processed to access freed memory.

Exploitation requires the packet to be processed from the socket backlog in task context.

1645) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-89480)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper validation of the received data length in the NVMe/TCP host driver when processing a short C2HData PDU from an NVMe/TCP controller. A remote attacker can respond to a read request with fewer bytes than requested to disclose sensitive information.

1646) Improper input validation (CVE-ID: CVE-2026-89481)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper input validation in nvme_tcp_handle_r2t() when processing an R2T request for a read command. A remote attacker can send an R2T request for a read command to disclose sensitive information.

The disclosed read destination buffer may contain stale kernel data.

1647) Out-of-bounds write (CVE-ID: CVE-2026-89482)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper validation of C2HData requests in the NVMe/TCP receive path when handling C2HData for a WRITE_ZEROES command with a residual iterator on the same tag. A remote attacker can send a C2HData request to trigger a wild memory write and cause a denial of service.

1648) Use of uninitialized resource (CVE-ID: CVE-2026-89483)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of uninitialized memory in the NVMe discard fallback page when processing discard commands. A local user can trigger a discard command that causes uninitialized DSM payload data to be sent to the controller to disclose sensitive information.

Exploitation requires the discard-range allocation to fail under memory pressure.

1649) NULL pointer dereference (CVE-ID: CVE-2026-89484)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in nlmclnt_locks_release_private() when releasing a partially initialized file_lock after lockowner allocation failure. A local user can trigger a lockowner allocation failure during NLM file lock initialization to cause a denial of service.

The VFS may release the partially initialized file lock after NLM client processing returns an out-of-memory error.

1650) Use-after-free (CVE-ID: CVE-2026-89485)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in the lockd nlm_traverse_files() file traversal routine when a concurrent nlm_release_file() frees the saved next file while nlm_file_mutex is dropped. A local user can trigger concurrent file release during file traversal to trigger a use-after-free condition.

1651) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-89487)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to modify page-cache data.

The vulnerability exists due to improper handling of zero-copy packet buffer flags in the Open vSwitch datapath when a failed USERSPACE upcall is followed by local ESP-in-UDP delivery. A local user can trigger a failed USERSPACE upcall followed by local ESP-in-UDP delivery to modify page-cache data.

Exploitation requires a MSG_ZEROCOPY packet carrying page-cache fragments.

1652) Use-after-free (CVE-ID: CVE-2026-89488)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a slab use-after-free.

The vulnerability exists due to a race condition leading to use-after-free in the Open vSwitch conntrack limit state when tearing down a network namespace while packet processing accesses the state. A local user can tear down a network namespace while packet processing accesses CT limit state to trigger a slab use-after-free.

Exploitation requires a user and network namespace.

1653) Untrusted Pointer Dereference (CVE-ID: CVE-2026-89489)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code in kernel context.

The vulnerability exists due to improper validation of user pointers in the sys_or1k_atomic syscall when processing syscall arguments. A local user can supply kernel addresses as syscall pointers to execute arbitrary code in kernel context.

1654) Incorrect Conversion between Numeric Types (CVE-ID: CVE-2026-89490)

CWE-ID: CWE-681 - Incorrect Conversion between Numeric Types

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering indefinite directory re-enumeration.

The vulnerability exists due to an incorrect integer conversion in ocfs2_dir_foreach_blk_el() when reading a non-inline directory that crosses the 4 GiB boundary on a 32-bit kernel. A local user can invoke readdir() on an affected directory to cause a denial of service by triggering indefinite directory re-enumeration.

64-bit kernels are unaffected.

1655) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-89491)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leave heartbeat regions unprotected on subsequent mounts.

The vulnerability exists due to improper error handling in o2hb_region_inc_user() when heartbeat region pinning fails partway through processing. A local user can invoke heartbeat region user registration during a pinning failure to leave heartbeat regions unprotected on subsequent mounts.

Partially pinned regions are not released, and the dependent-user counter remains incremented.

1656) Deadlock (CVE-ID: CVE-2026-89491)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a lock order inversion in o2hb_region_pin() when it is invoked from the configfs drop_item callback. A local user can trigger heartbeat-region removal processing to cause a denial of service.

1657) Improper locking (CVE-ID: CVE-2026-89491)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in o2hb_region_pin() when calling o2nm_depend_item() while holding o2hb_live_lock. A local user can trigger heartbeat region pinning to cause a denial of service.

The issue manifests as a sleeping-in-atomic-context BUG under CONFIG_DEBUG_ATOMIC_SLEEP.

1658) Out-of-bounds read (CVE-ID: CVE-2026-89492)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read memory beyond the bounds of a directory-index metadata block.

The vulnerability exists due to an out-of-bounds read in the OCFS2 directory index entry-list validation when processing a crafted on-disk image. A local user can supply a crafted image and access an indexed directory to read beyond the entry array.

Exploitation is reachable through path lookup, stat(), or open() operations after the image is mounted.

1659) Out-of-bounds write (CVE-ID: CVE-2026-89493)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to perform out-of-bounds memory reads and writes.

The vulnerability exists due to improper validation of refcount record bounds in ocfs2_validate_refcount_block() when processing crafted refcount blocks during reflink operations. A local privileged user can mount a crafted or corrupted ocfs2 image and issue a reflink operation to perform out-of-bounds memory reads and writes.

A raw write to the block device backing an already-mounted ocfs2 filesystem can also introduce a malicious refcount block.

1660) Out-of-bounds write (CVE-ID: CVE-2026-89494)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause memory corruption.

The vulnerability exists due to a heap out-of-bounds write in dlm_init_lockres() when processing a DLM_MIG_LOCKRES message with an oversized lock name length. A remote user can send a specially crafted DLM_MIG_LOCKRES message to cause memory corruption.

The sending node must belong to the DLM domain.

1661) Out-of-bounds read (CVE-ID: CVE-2026-89494)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in dlm_process_recovery_data() when processing a DLM_MIG_LOCKRES message whose claimed number of locks exceeds the message payload. A remote user can send a specially crafted DLM_MIG_LOCKRES message to cause a denial of service.

The sending node must belong to the DLM domain.

1662) Out-of-bounds read (CVE-ID: CVE-2026-89495)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in dlm_process_recovery_data when processing recovery data whose lock count exceeds the message payload. A remote user can send a malformed recovery message with an invalid number of lock entries to cause a denial of service.

1663) Heap-based buffer overflow (CVE-ID: CVE-2026-89495)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to corrupt memory or cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in dlm_mig_lockres_handler when processing recovery data with an oversized lock name. A remote user can send a malformed recovery message with an oversized lock name length to corrupt memory or cause a denial of service.

1664) Heap-based buffer overflow (CVE-ID: CVE-2026-89495)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to corrupt memory or cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in dlm_migrate_request_handler when processing a DLM_MIGRATE_REQUEST message with an oversized name. A remote user can send a malformed migration request with an oversized name length to corrupt memory or cause a denial of service.

1665) Memory leak (CVE-ID: CVE-2026-89496)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to improper resource release in OCFS2 copy-on-write completion when performing copy_file_range() within the same filesystem. A local user can invoke copy_file_range() to cause a memory leak.

1666) Heap-based buffer overflow (CVE-ID: CVE-2026-89497)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write past the end of an allocated keyword buffer.

The vulnerability exists due to a heap-based buffer overflow in orangefs_prepare_cdm_array() when processing a client debug entry that begins with a space. A local user can supply a client debug entry beginning with a space to write past the end of an allocated keyword buffer.

1667) Double free (CVE-ID: CVE-2026-89498)

CWE-ID: CWE-415 - Double Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a double-free.

The vulnerability exists due to double free in the OrangeFS readdir downcall handling when processing a readdir downcall with a declared trailer size that exceeds the supplied data. A local user can send a readdir downcall with insufficient trailer data to trigger a double-free.

1668) Memory leak (CVE-ID: CVE-2026-89500)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect memory page order handling in the ring buffer cached reader page handling when discarding a cached reader page after a concurrent ring buffer resize. A local user can cause a cached reader page to be discarded after a concurrent ring buffer resize to cause a denial of service.

1669) Race condition (CVE-ID: CVE-2026-89501)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a race condition involving cpu_buffer->free_page.

The vulnerability exists due to improper synchronization in trace ring buffer resizing when changing a sub-buffer order. A local user can race sub-buffer resizing with read-page allocation or freeing operations to cause a race condition involving cpu_buffer->free_page.

1670) Mismatched Memory Management Routines (CVE-ID: CVE-2026-89502)

CWE-ID: CWE-762 - Mismatched Memory Management Routines

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to mismatched memory management routines in the ring buffer CPU buffer cleanup routine when freeing cpu_buffer->free_page allocated with a sub-buffer order greater than zero. A local user can trigger cleanup of an affected CPU buffer to cause a memory leak.

1671) Race condition (CVE-ID: CVE-2026-89503)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a mismatch between reader-page metadata and allocated memory.

The vulnerability exists due to a race condition in ring_buffer_alloc_read_page() when resizing ring-buffer subbuffers while allocating a reader page. A local user can race reader-page allocation with a subbuffer-order change to cause a mismatch between reader-page metadata and allocated memory.

1672) Use-after-free (CVE-ID: CVE-2026-89504)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger use of a dangling device-tree node pointer.

The vulnerability exists due to improper reference counting in as3722_get_regulator_dt_data() when parsing regulator device-tree data. A local user can cause the dangling pointer to be used to trigger use of a dangling device-tree node pointer.

1673) Race condition (CVE-ID: CVE-2026-89508)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in ucma_set_ib_path() when concurrently handling SET_OPTION requests and context migration. A local user can trigger a race condition to cause a denial of service.

A bound and address-resolved cm_id and an RDMA device are required.

1674) Use-after-free (CVE-ID: CVE-2026-89510)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a use-after-free condition.

The vulnerability exists due to a race condition in the RDMA/cxgb4 device removal and registration work handling when removing an RDMA device while registration work is pending or running. A local privileged user can remove the device while the registration work accesses the device object to cause a use-after-free condition.

1675) NULL pointer dereference (CVE-ID: CVE-2026-89511)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the qede driver's TPA fragment processing when handling TPA continuation fragments under memory pressure. A remote attacker can send network traffic that is processed as TPA continuation fragments during memory pressure to cause a denial of service.

1676) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-89512)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to missing release of a resource after effective lifetime in the scp_get function in drivers/remoteproc/mtk_scp.c when looking up SCP driver data before the driver has been bound. A local user can trigger a failed SCP driver-data lookup to cause a denial of service.

1677) Use of uninitialized resource (CVE-ID: CVE-2026-89515)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized memory contents.

The vulnerability exists due to use of uninitialized memory in scsi_alloc_sgtables() when processing the last unaligned element of a scatterlist requiring DMA padding. A local user can issue an SCSI generic I/O request with an unaligned final scatterlist element to disclose uninitialized memory contents.

1678) Race condition (CVE-ID: CVE-2026-89520)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in core scheduling's pick_next_task() when a core scheduling flip occurs while a lock-dropping pick_task() operation is in progress. A local user can trigger concurrent core scheduling flips and task selections to cause a denial of service.

Only systems using core scheduling are affected.

1679) Integer underflow (CVE-ID: CVE-2026-89524)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an integer underflow in ath6kl_cfg80211_connect_event() when handling association events with request or response lengths shorter than their fixed information element offsets. A remote attacker can trigger such an association event to disclose sensitive information.

1680) Out-of-bounds read (CVE-ID: CVE-2026-89525)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in udf_get_pblock_virt15() when processing a crafted UDF image. A local user can mount a crafted UDF image to cause a denial of service.

The issue affects UDF 1.50 virtual partition mappings that use a VAT.

1681) Out-of-bounds read (CVE-ID: CVE-2026-89526)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in RPC/RDMA Read chunk reconstruction when processing crafted Read chunk positions supplied by a remote client. A remote attacker can supply out-of-range or overlapping Read chunk positions to disclose sensitive information.

1682) Improper resource shutdown or release (CVE-ID: CVE-2026-89527)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause resource leaks.

The vulnerability exists due to improper resource release in svc_rdma_create() when listener creation fails. A local user can trigger listener creation failure to cause resource leaks.

1683) Heap-based buffer overflow (CVE-ID: CVE-2026-89530)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt adjacent slab memory.

The vulnerability exists due to a heap-based buffer overflow in svc_rdma_xb_linearize() when processing oversized inline RPC-over-RDMA replies without a Write list or Reply chunk. A remote attacker can request an oversized inline reply without providing a Write list or Reply chunk to corrupt adjacent slab memory.

The posted scatter/gather entry length can cause the device to read beyond the mapped region.

1684) Memory leak (CVE-ID: CVE-2026-89531)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in the svcrdma handle_connect_req() connection handler when transport allocation fails while processing connection requests. A remote attacker can send repeated connection attempts during memory pressure to cause a denial of service.

1685) Out-of-bounds read (CVE-ID: CVE-2026-89532)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer underflow resulting in an out-of-bounds read in the pcl_for_each_segment macro when processing a Write or Reply chunk with zero segments. A remote attacker can send a crafted Write or Reply chunk advertising zero segments to cause a denial of service.

The transport must have negotiated Send-With-Invalidate.

1686) Integer underflow (CVE-ID: CVE-2026-89533)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer underflow in svc_rdma_read_chunk_range() when processing a Read chunk segment list with crafted offsets and lengths. A remote attacker can submit a crafted Read chunk to cause a denial of service.

1687) Use-after-free (CVE-ID: CVE-2026-89536)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to a use-after-free in SUNRPC client TLS handshake handling when cancellation loses a race with completion of a TLS handshake callback. A local user can interrupt or time out a synchronous TLS handshake wait while the completion callback is in flight to cause a use-after-free condition.

1688) Improper input validation (CVE-ID: CVE-2026-89538)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper input validation in gss_krb5_unwrap_v2() when processing Kerberos v2 wrap tokens with oversized extra count fields. A remote user can send a malformed Kerberos v2 wrap token to cause a denial of service.

The token must be encrypted using a valid GSS context.

1689) Memory leak (CVE-ID: CVE-2026-89539)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in gssx_dec_option_array() when processing a reply containing duplicate CREDS_VALUE options. A remote attacker can send a crafted reply containing duplicate CREDS_VALUE options to cause a denial of service.

1690) Race condition (CVE-ID: CVE-2026-89540)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a resource leak.

The vulnerability exists due to an initialization race condition in the use-gss-proxy proc entry initialization when writing to the newly published proc entry before gssp_lock is initialized. A local user can win the initialization race and write to the proc entry to cause a resource leak.

The race window can widen when the auth_rpcgss module is loaded for live network namespaces.

1691) Out-of-bounds read (CVE-ID: CVE-2026-89541)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read out-of-bounds memory.

The vulnerability exists due to improper length validation in gss_unwrap_resp_priv() when processing a crafted RPCSEC_GSS reply. A remote attacker can return a crafted RPCSEC_GSS reply from a krb5p NFS server to read out-of-bounds memory.

1692) Out-of-bounds read (CVE-ID: CVE-2026-89542)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper length validation in gss_krb5_unwrap_v2() and its rotation helpers when processing a short or malformed GSS token. A remote user can provide a token shorter than the required header or with a declared length exceeding the buffer bounds to cause a denial of service.

The flawed length arithmetic can result in an out-of-bounds read, an unsigned underflow during cleanup, or a divide-by-zero during buffer rotation.

1693) Use-after-free (CVE-ID: CVE-2026-89543)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Linux kernel SunRPC client pipefs directory handling when accessing stale pipefs entries after a late mount or remount. A local user can invoke rpc_info_open() or rpc_show_info() on a stale pipefs entry to cause a denial of service.

1694) NULL pointer dereference (CVE-ID: CVE-2026-89544)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in the SUNRPC gssx XDR option-array decoder when handling an allocation failure while decoding an option array. A local user can trigger the decoder's error path to cause a denial of service.

The affected error paths also include a group_info reference-count leak and a latent use-after-free condition.

1695) Use-after-free (CVE-ID: CVE-2026-89545)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to improper RCU synchronization in the SunRPC service request cleanup routine when RCU readers traverse the thread list after a service request is removed. A local user can cause RCU readers to dereference freed request argument memory to trigger a use-after-free.

The issue affects request data accessed by readers such as nfsd_nl_rpc_status_get_dumpit().

1696) Unchecked Return Value (CVE-ID: CVE-2026-89547)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to corrupt kernel memory.

The vulnerability exists due to unchecked return values in the SUNRPC RPC service pool counter initialization in __svc_create() when starting an RPC service while per-CPU counter allocation fails. A local privileged user can start an RPC service under allocation failure conditions to corrupt kernel memory.

Exploitation requires memory pressure or fault injection during RPC server startup; a remote peer cannot induce the failed allocation state on its own.

1697) Use-after-free (CVE-ID: CVE-2026-89548)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to improper synchronization in the SUNRPC cache cleanup routine when tearing down a network namespace. A local user can cause cache_clean() to access a freed cache_detail to trigger a use-after-free condition.

1698) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-89549)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a service connection to hang indefinitely.

The vulnerability exists due to improper handling of threadless service pools in svc_pool_for_cpu() when routing a transport to a service pool. A remote attacker can initiate a connection that is enqueued on a pool with no service threads to cause a service connection to hang indefinitely.

The condition can occur when a service has fewer threads than configured pools.

1699) Division by zero (CVE-ID: CVE-2026-89550)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper input validation in svcauth_gss_unwrap_priv() when handling a crafted short krb5 token. A remote user can send a crafted token that triggers a division by zero to cause a denial of service.

The issue affects krb5 v2 contexts.

1700) Integer underflow (CVE-ID: CVE-2026-89551)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause downstream XDR decoders to use an incorrect stream bound.

The vulnerability exists due to an integer underflow in xdr_buf_trim() when processing GSS Kerberos v2 data whose recorded buffer length is smaller than the associated I/O vector lengths. A remote attacker can cause xdr_buf_trim() to consume more bytes than buf->len records to cause downstream XDR decoders to use an incorrect stream bound.

1701) NULL pointer dereference (CVE-ID: CVE-2026-89552)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of allocation failures in param_set_charp() when updating charp parameters after slab allocation is available. A local user can update a charp parameter during an allocation failure to cause a denial of service.

The issue can be triggered by a failed zswap compressor update before zswap is initialized.

1702) Use-after-free (CVE-ID: CVE-2026-89553)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to a use-after-free in the nouveau GEM information ioctl when racing an information lookup with a GEM close operation. A local user can race an information ioctl with a GEM close operation to trigger a use-after-free.

Only the non-uvmm path is affected.

1703) Use of Uninitialized Variable (CVE-ID: CVE-2026-89554)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt the path manager's id-based subflow bookkeeping.

The vulnerability exists due to use of an uninitialized local_id field in mptcp_token_join_cookie_init_state() when reconstructing MP_JOIN request sockets for fourth acknowledgments under SYN cookies. A remote attacker can send concurrent MP_JOIN SYNs to influence the stale address ID and corrupt the path manager's id-based subflow bookkeeping.

1704) Use-after-free (CVE-ID: CVE-2026-89555)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a use-after-free.

The vulnerability exists due to use-after-free in mpls_multipath_hash when processing MPLS packets with inner IP headers in non-linear data and insufficient tailroom in the linear head. A remote attacker can send a legal Geneve packet through a bareudp/MPLS multipath setup to trigger a use-after-free.

The IPv6 processing path can perform a second pull for the larger header.

1705) Integer overflow (CVE-ID: CVE-2026-89557)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an integer overflow.

The vulnerability exists due to improper input validation in the super_1_load() MD superblock loader when processing a crafted on-disk superblock. A local user can supply a crafted on-disk superblock to trigger an integer overflow.

1706) Integer overflow (CVE-ID: CVE-2026-89559)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds write.

The vulnerability exists due to an integer overflow in __nd_label_validate() in the libnvdimm label handler when processing a crafted nslot namespace index value. A local user can supply crafted configuration data through ND_CMD_SET_CONFIG_DATA to perform an out-of-bounds write.

The nslot field may also originate from DIMM label storage.

1707) Missing Authorization (CVE-ID: CVE-2026-89560)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass Landlock filesystem access restrictions.

The vulnerability exists due to improper access control in Landlock whiteout creation checks when creating whiteout objects with mknod(2) or renameat2(2) using RENAME_WHITEOUT. A local user can create a whiteout object despite denied required Landlock access rights to bypass Landlock filesystem access restrictions.

Normal renames within layered OverlayFS mounts are not affected.

1708) NULL pointer dereference (CVE-ID: CVE-2026-89561)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in ipv6_rpl_srh_rcv() when processing RPL segment routing packets after the receiving interface's IPv6 device pointer has been cleared during an MTU transition. A remote attacker can send RPL segment routing packets during the MTU transition to cause a denial of service.

1709) Incorrect calculation (CVE-ID: CVE-2026-89562)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect tunnel hardware header length handling.

The vulnerability exists due to improper hardware header length calculation in ip6_gre tunnel configuration when configuring an NBMA ip6gre tunnel. A local user can configure an NBMA ip6gre tunnel to cause incorrect tunnel hardware header length handling.

ip6gretap and ip6erspan use fixed Ethernet hardware header lengths.

1710) Double free (CVE-ID: CVE-2026-89563)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in ip6_tnl_xmit() when handling errors after expanding packet headroom. A local user can trigger an error after packet headroom expansion to cause a denial of service.

The issue is reachable when collect_md tunnels reject a non-NONE encapsulation type or when ip6_tnl_encap() fails.

1711) Use-after-free (CVE-ID: CVE-2026-89564)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a use-after-free.

The vulnerability exists due to improper socket reference management in IPv4 and IPv6 multicast forwarding paths when processing non-locally deliverable multicast packets. A remote attacker can send a non-locally deliverable multicast packet to trigger a use-after-free.

Exploitation requires the associated prefetched socket to be destroyed before the socket buffer is freed.

1712) Memory leak (CVE-ID: CVE-2026-89565)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a resource leak in ipip_tunnel_rcv() when processing packets in collect_md mode after metadata_dst allocation fails. A local user can trigger packet processing under these conditions to cause a denial of service.

The issue can be triggered through an ipip or mplsip tunnel configured in collect_md mode.

1713) Improper locking (CVE-ID: CVE-2026-89566)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in journal_shrink_one_cp_list() when skipping busy checkpoint buffers during checkpoint-list shrinking. A local user can trigger checkpoint-list shrinking under memory pressure to cause a denial of service.

The condition occurs when a checkpoint list contains mostly busy buffers.

1714) Resource exhaustion (CVE-ID: CVE-2026-89567)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper scan-budget accounting in the jbd2 checkpoint shrinker when scanning checkpoint lists containing mostly busy buffers. A local user can cause a checkpoint transaction to contain mostly busy buffers to cause a denial of service.

1715) Use-after-free (CVE-ID: CVE-2026-89569)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to access freed RFCOMM session and data link connection objects.

The vulnerability exists due to use-after-free in the RFCOMM security confirmation handler rfcomm_security_cfm() when processing Bluetooth security confirmations concurrently with RFCOMM session teardown. A remote attacker can trigger the concurrent processing to access freed RFCOMM session and data link connection objects.

1716) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-89572)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper resource cleanup in the Apple SoC CPU frequency driver when initializing or exiting CPU frequency policies. A local privileged user can trigger repeated CPU frequency policy initialization failures to cause a denial of service.

1717) Out-of-bounds read (CVE-ID: CVE-2026-89573)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read out-of-bounds memory.

The vulnerability exists due to improper validation of array block value sizes in dm-array's get_ablock() and __shadow_ablock() functions when processing crafted dm-cache metadata. A local user can cause a mappings array to reference a hint block with a smaller value size to read out-of-bounds memory.

1718) Out-of-bounds read (CVE-ID: CVE-2026-89574)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read beyond the dm-bufio buffer.

The vulnerability exists due to improper validation of on-disk array block headers in the dm-array component when loading dm-cache mappings from on-disk array blocks. A local user can cause dm_cache_load_mappings() to process an array block header whose entry count exceeds its capacity to read beyond the dm-bufio buffer.

The vulnerable path is reached during dm-cache activation.

1719) Heap-based buffer overflow (CVE-ID: CVE-2026-89575)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a heap-based buffer overflow.

The vulnerability exists due to improper buffer size calculation in build_constructor_string() when formatting a maximum-length u64 value. A local privileged user can cause sprintf() to write a terminating NUL byte beyond the allocated buffer space to cause a heap-based buffer overflow.

1720) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-89576)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through metadata block exhaustion.

The vulnerability exists due to improper resource release in metadata_take_snap() when incrementing metadata block references fails after allocating a shadow superblock. A local user can cause snapshot creation to fail after a shadow block is allocated to cause a denial of service through metadata block exhaustion.

1721) Out-of-bounds write (CVE-ID: CVE-2026-89579)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to escalate privileges.

The vulnerability exists due to out-of-bounds memory access in the BPF bloom filter bitset allocation and indexing logic when processing BPF bloom filter map operations on 32-bit kernels. A local privileged user can create a bloom filter map with a maximal bitset and perform updates to escalate privileges.

Exploitation is possible on 32-bit x86 kernels from a binary with CAP_BPF.

1722) Out-of-bounds write (CVE-ID: CVE-2026-89580)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write out of bounds.

The vulnerability exists due to a race condition in __bpf_get_stack when a preemptible BPF program accesses a reused per-CPU callchain buffer. A local user can execute a preemptible BPF program to write out of bounds.

The issue can affect non-sleepable raw tracepoint programs on PREEMPT kernels.

1723) Double free (CVE-ID: CVE-2026-89582)

CWE-ID: CWE-415 - Double Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a double free.

The vulnerability exists due to a double free in bnx2x_init_firmware() when firmware initialization fails and bnx2x_release_firmware() is subsequently called. A local user can cause firmware initialization to fail and invoke the affected cleanup path to trigger a double free.

1724) Out-of-bounds read (CVE-ID: CVE-2026-89583)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in eir_get_service_data() when processing periodic advertising data containing mismatching Service Data fields. A remote attacker can transmit a crafted periodic advertising payload to disclose sensitive information.

Exploitation requires an ISO broadcast sink to process periodic advertising reports from a remote broadcaster.

1725) Use-after-free (CVE-ID: CVE-2026-89585)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access freed memory.

The vulnerability exists due to use-after-free in the charlcd registration error-handling path when a character LCD registration attempt fails while backlight flashing is enabled. A local user can trigger delayed backlight work after the charlcd object is freed to access freed memory.

1726) Incorrect calculation (CVE-ID: CVE-2026-89586)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect calculation in ata_scsi_write_same_xlat() and ata_format_dsm_trim_descr() when issuing SCSI WRITE SAME commands with the UNMAP bit set. A local user can issue a SCSI WRITE SAME command with the UNMAP bit set to cause a denial of service.

The issue affects devices whose logical sector size exceeds 2048 bytes.

1727) Stack-based buffer overflow (CVE-ID: CVE-2026-89587)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt stack memory.

The vulnerability exists due to a stack-based buffer overflow in the query_capability() function when processing firmware _DSM buffer objects. A local user can invoke the PFRU ioctl while firmware returns oversized _DSM buffers to corrupt stack memory.

The affected capability-information structure is stack-allocated in pfru_ioctl().

1728) Out-of-bounds read (CVE-ID: CVE-2026-89588)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read past a CPER section.

The vulnerability exists due to incorrect length accounting in ghes_handle_arm_hw_error() when processing ARM hardware error sections. A local user can trigger parsing of a CPER section with a large err_info_num relative to error_data_length to read past a CPER section.

1729) Improper initialization (CVE-ID: CVE-2026-89594)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in the OMAP SSI controller device when performing DMA mapping operations. A local user can trigger DMA mapping operations to cause a denial of service.

1730) Race condition (CVE-ID: CVE-2026-89595)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause filesystem monitoring events to be missed.

The vulnerability exists due to a race condition in cached fsnotify object mask recalculation when concurrently updating fanotify or inotify marks on the same connector. A local user can issue concurrent mark updates to cause filesystem monitoring events to be missed.

1731) Off-by-one (CVE-ID: CVE-2026-89596)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an off-by-one error in the forcedeth driver's nv_suspend() and nv_resume() functions when suspending or resuming the system. A local user can trigger a system suspend and resume cycle to cause a denial of service.

On systems built with CONFIG_UBSAN_TRAP=y, the out-of-bounds access aborts the running kernel code.

1732) Improper resource shutdown or release (CVE-ID: CVE-2026-89597)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to leave a v86d connector callback registered after initialization fails.

The vulnerability exists due to improper resource shutdown or release in uvesafb_init() when platform driver registration fails after registering the v86d connector callback. A local privileged user can initialize uvesafb to leave the callback registered.

1733) Improper locking (CVE-ID: CVE-2026-89598)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in the ssd1307fb framebuffer driver when processing framebuffer damage callbacks while preemption is disabled. A local user can trigger a display update to cause a denial of service.

The issue affects SSD1307 framebuffer devices that use I2C transfers.

1734) Race condition (CVE-ID: CVE-2026-89599)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a dsicm callback to use an uninitialized mutex.

The vulnerability exists due to a race condition in the dsicm_probe() function of the panel-dsi-cm display driver when a consumer reaches a dsicm callback after the display is registered but before ddata->lock is initialized. A local user can trigger a dsicm callback during this interval to cause a dsicm callback to use an uninitialized mutex.

1735) Resource exhaustion (CVE-ID: CVE-2026-89604)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the efivarfs statfs() handler when repeatedly invoking statfs() on the efivarfs mount point. A local user can flood the QueryVariableInfo() runtime service with statfs() calls to cause a denial of service.

On x86 systems with a variable store backed by SMM, each runtime-service entry requires a rendezvous of all CPUs.

1736) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-89605)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to failure to release a message context in ecryptfs messaging when sending a message to the userspace daemon fails. A local user can trigger message delivery failures to exhaust reusable message contexts.

1737) Integer underflow (CVE-ID: CVE-2026-89606)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an integer underflow.

The vulnerability exists due to an integer underflow in ecryptfs_parse_tag_70_packet() when parsing malformed tag 70 packets. A local user can provide a tag 70 packet with a body smaller than the required fixed metadata fields to trigger an integer underflow.

1738) Out-of-bounds write (CVE-ID: CVE-2026-89607)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to out-of-bounds writes in parse_tag_3_packet() and decrypt_passphrase_encrypted_session_key() when processing a crafted Tag 3 packet through the passphrase decryption path. A local user can supply a crafted Tag 3 packet with an oversized encrypted key size to cause memory corruption.

Only the AES-192 cipher configuration enables exploitation because its key size is set independently of the encrypted key size.

1739) Out-of-bounds read (CVE-ID: CVE-2026-89608)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds read.

The vulnerability exists due to improper bounds checking in ecryptfs_parse_packet_set() when parsing an eCryptfs version 1 file header. A local user can trigger parsing of an eCryptfs version 1 file header to perform an out-of-bounds read.

1740) Improper locking (CVE-ID: CVE-2026-89609)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a race condition.

The vulnerability exists due to improper locking in ecryptfs_exorcise_daemon() when cleaning queued messages from a dying daemon. A local user can move queued message contexts to the free list without holding the required global list lock to trigger a race condition.

1741) Out-of-bounds write (CVE-ID: CVE-2026-89615)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds write.

The vulnerability exists due to an out-of-bounds write in the page_lcns[] array handling of the NTFS3 log replay code when processing a crafted log record. A local user can provide a crafted log record with an lcns_follow count that exceeds the target entry's capacity to perform an out-of-bounds write.

1742) Use of uninitialized resource (CVE-ID: CVE-2026-89616)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper initialization in ni_read_frame() when reading a crafted compressed NTFS file. A local user can trigger partial LZNT decompression to disclose sensitive information.

Disclosed data can include recently freed kernel page memory and kernel pointers.

1743) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-89617)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds memory access.

The vulnerability exists due to improper validation of an on-disk array length in DIR_PAGE_ENTRY entries during NTFS3 log replay when replaying a crafted NTFS log. A local user can provide a crafted lcns_follow value that exceeds the page_lcns[] entry bounds to cause an out-of-bounds memory access.

1744) Improper initialization (CVE-ID: CVE-2026-89618)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a false warning.

The vulnerability exists due to improper initialization in eventfs_inode list heads when eventfs_create_dir() fails due to memory pressure. A local user can trigger directory creation failure due to memory pressure to cause a false warning.

1745) Out-of-bounds read (CVE-ID: CVE-2026-89621)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose uninitialized kernel memory.

The vulnerability exists due to an out-of-bounds read in mcp2221_raw_event() in the MCP2221 HID driver when handling a short MCP2221_I2C_GET_DATA HID report. An attacker with physical access can send a crafted HID report with a length value exceeding the received report size to disclose uninitialized kernel memory.

1746) Use-after-free (CVE-ID: CVE-2026-89622)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 1 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to a write use-after-free in the MCP2221 HID driver's mcp_i2c_smbus_read() and mcp2221_raw_event() functions when processing a delayed or spurious MCP2221_I2C_GET_DATA report after an I2C/SMBus transfer has ended. An attacker with physical access can trigger a report that writes device data to freed memory to cause memory corruption.

1747) Use-after-free (CVE-ID: CVE-2026-89623)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to improper device I/O shutdown in the MCP2221 HID driver cleanup callback when incoming HID reports race with hardware teardown during probe failure or device removal. A local user can trigger the race condition to trigger a use-after-free.

1748) Use-after-free (CVE-ID: CVE-2026-89624)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write to freed memory.

The vulnerability exists due to improper resource shutdown in universal_pidff_probe() when opening a surviving /dev/hidrawX device after force-feedback initialization fails. A local user can open the surviving device to write to freed memory.

A descriptor with a PID usage page and no input reports can cause force-feedback initialization to fail after the device starts.

1749) Use-after-free (CVE-ID: CVE-2026-89625)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a use-after-free condition.

The vulnerability exists due to use-after-free in GHL poke timer handling in the hid-sony driver when handling driver unbind while a GHL poke URB is in flight. A local privileged user can trigger a driver unbind while the GHL poke URB is in flight to cause a use-after-free condition.

The issue affects Guitar Hero Live dongles, where a URB completion can re-arm the timer after driver teardown.

1750) Use-after-free (CVE-ID: CVE-2026-89626)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to improper cleanup in hid_sensor_custom_add_attributes() when creating sysfs groups for custom sensor fields. A local user can trigger a sysfs group creation failure to cause a use-after-free.

1751) Memory leak (CVE-ID: CVE-2026-89627)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory release in the ROCcat HID device destruction paths when destroying a device with buffered reports stored in its circular buffer. A local user can trigger the affected device destruction path while buffered reports remain stored to cause a denial of service.

Up to ROCCAT_CBUF_SIZE report buffers per device can become unreachable.

1752) Out-of-bounds read (CVE-ID: CVE-2026-89628)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in picolcd_debug_eeprom_read() when reading EEPROM data through the debugfs "eeprom" file. A local privileged user can use a crafted or spoofed picoLCD device to supply an oversized length value to disclose sensitive information.

The debugfs file is accessible only to root.

1753) Out-of-bounds write (CVE-ID: CVE-2026-89633)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause out-of-bounds reads and writes.

The vulnerability exists due to improper input validation in coalesce_t2() when processing SMB transaction responses containing server-supplied DataOffset fields. A remote attacker can send a crafted response with malicious DataOffset values to cause out-of-bounds reads and writes.

1754) Integer overflow (CVE-ID: CVE-2026-89634)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer overflow in symlink_data() in fs/smb/client/smb2file.c when processing an SMB error context with a malformed ErrorDataLength value. A remote attacker can provide a crafted SMB error context to cause a denial of service.

1755) Use-after-free (CVE-ID: CVE-2026-89636)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to use-after-free in the SMB client DFS cache's free_tgts() function when using ce->tgthint after its target entries have been freed. A local user can trigger use of the stale target cache hint to cause a use-after-free.

1756) Improper Preservation of Permissions (CVE-ID: CVE-2026-89638)

CWE-ID: CWE-281 - Improper preservation of permissions

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to improper preservation of permissions in the cifs_setattr_unix() and cifs_setattr_nounix() routines when processing writes to files with setuid or setgid bits set. A local user can write to such a file and retain its setuid or setgid bits on the server to escalate privileges.

The issue occurs when the mount stores modes on the server through cifsacl or modefromsid, SMB3.1.1 POSIX extensions, or SMB1 Unix extensions.

1757) Integer underflow (CVE-ID: CVE-2026-89640)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt the ByteCount in a file-clone request.

The vulnerability exists due to an integer underflow in cifs_remap_file_range() when issuing a clone-to-EOF operation with a source offset beyond the end of the source file. A local user can invoke a clone-to-EOF operation with an out-of-range source offset to corrupt the ByteCount in a file-clone request.

1758) Use-after-free (CVE-ID: CVE-2026-89643)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a use-after-free in audit_del_rule() when fsnotify automatically removes mixed AUDIT_DIR and AUDIT_EXE rules that share an audit tree. A local privileged user can trigger fsnotify autoremove events to cause a denial of service.

1759) Memory leak (CVE-ID: CVE-2026-89644)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a resource leak.

The vulnerability exists due to missing release of memory after effective lifetime in btrfs_get_blocks_direct_write() when performing a direct I/O write to a NOCOW range and ordered extent allocation fails. A local user can issue a direct I/O write to a NOCOW range to cause a resource leak.

1760) Memory leak (CVE-ID: CVE-2026-89645)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a reference leak.

The vulnerability exists due to improper reference counting in btrfs relocation recovery when handling recovery failures. A local user can trigger a relocation recovery failure to cause a reference leak.

The issue occurs if loading or adding a later root fails, or if the first transaction commit fails during relocation recovery.

1761) Infinite loop (CVE-ID: CVE-2026-89647)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an infinite loop in the Ceph dentry lease reclamation logic when processing valid leases with no cap pressure. A local user can cause ceph_cap_reclaim_work() to repeatedly requeue dentry trimming to cause a denial of service.

1762) Out-of-bounds read (CVE-ID: CVE-2026-89649)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the CephFS __build_xattrs() function when processing metadata-server-supplied extended attribute blobs. A remote privileged user can provide a crafted extended attribute blob with a final attribute value length that exceeds the available data to disclose sensitive information.

A local user must invoke getxattr(2) on a CephFS file.

1763) Out-of-bounds read (CVE-ID: CVE-2026-89650)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an out-of-bounds read in the kernel.

The vulnerability exists due to an out-of-bounds read in ceph_mdsmap_decode() in fs/ceph/mdsmap.c when processing an MDS map with a per-mds info version of 2 or 3 and an oversized num_export_targets field. A remote attacker can send a specially crafted MDS map to cause an out-of-bounds read in the kernel.

On-path exploitation applies to unsigned or unencrypted messenger sessions.

1764) Out-of-bounds write (CVE-ID: CVE-2026-89652)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause memory corruption.

The vulnerability exists due to improper bounds checking in the CephFS NFS-export get_name functions when processing LOOKUPNAME replies containing oversized dentry names. A remote user can return a specially crafted LOOKUPNAME reply to cause memory corruption.

The issue is reachable when a CephFS mount is re-exported over NFS.

1765) Out-of-bounds write (CVE-ID: CVE-2026-89653)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause an out-of-bounds write.

The vulnerability exists due to improper bounds checking in the fixed stack bitmap used by check_new_map() when processing a decoded MDSMap whose export_targets entries contain an out-of-range rank. A remote user can cause an MDSMap containing an out-of-range export target rank to be decoded to cause an out-of-bounds write.

1766) Use-after-free (CVE-ID: CVE-2026-89655)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in __kick_flushing_caps() when processing FLUSH_ACK messages during cap flushing. A remote attacker can send a FLUSH_ACK message during cap flushing to trigger a use-after-free condition.

Exploitation requires the FLUSH_ACK to be processed after i_ceph_lock is released and before list iteration resumes.

1767) Out-of-bounds write (CVE-ID: CVE-2026-89656)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write beyond the CRUSH workspace.

The vulnerability exists due to improper validation of bucket IDs in the libceph CRUSH map decoder, crush_decode(), when processing a malformed CRUSH map containing a bucket ID that does not match its array slot. A local user can cause the kernel to process such a map and write past a permutation array into memory beyond the CRUSH workspace.

1768) Improper input validation (CVE-ID: CVE-2026-89657)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper input validation in the osd_sparse_read() sparse-read extent map handling when processing a malformed sparse-read reply. A remote user can send a malformed sparse-read reply to cause a denial of service.

1769) Use-after-free (CVE-ID: CVE-2026-89659)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to trigger a use-after-free.

The vulnerability exists due to a use-after-free in NFSD delegation revocation when an expired recalled delegation is revoked concurrently with client teardown. A remote user can race delegation revocation with client teardown to trigger a use-after-free.

During the race window, the delegation is on neither the client's active-delegation list nor revoked-delegation list.

1770) Use-after-free (CVE-ID: CVE-2026-89662)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the NFSD __destroy_client() function when processing DESTROY_CLIENTID requests. A remote attacker can trigger client teardown while blocked locks are reaped to cause a denial of service.

The race can result in a NULL dereference in remove_blocked_locks().

1771) Use-after-free (CVE-ID: CVE-2026-89663)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the NFS server copy-notify stateid revocation logic when revoking copy-notify stateids while concurrent holders retain references. A remote attacker can trigger concurrent copy-notify stateid revocation to cause a denial of service.

The issue involves parent-stateid draining, OFFLOAD_CANCEL handling, and laundromat expiry.

1772) Integer overflow (CVE-ID: CVE-2026-89665)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause improper filesystem timestamp handling.

The vulnerability exists due to an integer overflow in the NFSv2 sattr decoder in svcxdr_decode_sattr() when decoding NFSv2 SETATTR or CREATE time attributes. A remote attacker can send a crafted NFSv2 request containing an out-of-range useconds value to cause improper filesystem timestamp handling.

The overflow affects 32-bit ILP32 platforms.

1773) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-89666)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt on-disk timestamp metadata.

The vulnerability exists due to improper validation of specified quantities in input in NFSv3 SETATTR and create operation handlers when processing client-supplied atime or mtime values with an out-of-range nanoseconds field. A remote attacker can send specially crafted NFSv3 SETATTR, CREATE, MKDIR, SYMLINK, or MKNOD requests to corrupt on-disk timestamp metadata.

Affected filesystems include ext4 and XFS with bigtime support.

1774) Use-after-free (CVE-ID: CVE-2026-89669)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a use-after-free condition.

The vulnerability exists due to a use-after-free in copy-notify state initialization when racing a crafted OFFLOAD_CANCEL request against COPY_NOTIFY processing. A remote attacker can send a crafted OFFLOAD_CANCEL request to trigger a use-after-free condition.

Exploitation requires a matching client ID and a guessable state object ID.

1775) Improper input validation (CVE-ID: CVE-2026-89671)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to remove POSIX ACLs.

The vulnerability exists due to improper input validation in nfsd3_proc_setacl() when processing NFSv3 SETACL requests with omitted ACL mask bits. A remote attacker can send a SETACL request with omitted ACL mask bits to remove POSIX ACLs.

1776) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-89672)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to remove POSIX ACLs.

The vulnerability exists due to improper handling of omitted ACL fields in the NFSACL v2 SETACL handler when processing SETACL requests with omitted ACL mask bits. A remote attacker can send a SETACL request with omitted ACL mask bits to remove POSIX ACLs.

A request containing only the NFS_ACL mask bit removes the directory's default ACL, while a request with a zero mask removes both ACL types.

1777) Improper Handling of Length Parameter Inconsistency (CVE-ID: CVE-2026-89673)

CWE-ID: CWE-130 - Improper Handling of Length Parameter Inconsistency

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose stale reply-page content.

The vulnerability exists due to an incorrect XDR padding calculation in nfsd4_ff_encode_getdeviceinfo() when encoding flexfile GETDEVICEINFO replies. A remote attacker can send a GETDEVICEINFO request to disclose stale reply-page content.

The incorrect declared address-body length can also mis-align decoding of the subsequent version list.

1778) Out-of-bounds write (CVE-ID: CVE-2026-89674)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to write beyond the reserved XDR buffer or disclose uninitialized kernel memory.

The vulnerability exists due to an incorrect XDR buffer size calculation in nfsd4_ff_encode_layoutget() when encoding layoutget responses with short user or group strings and an odd-sized file handle. A remote attacker can request a layoutget operation to write beyond the reserved XDR buffer or disclose uninitialized kernel memory.

1779) Expired pointer dereference (CVE-ID: CVE-2026-89676)

CWE-ID: CWE-825 - Expired pointer dereference

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an expired pointer dereference in the nfsd asynchronous COPY stateid IDR handling when processing asynchronous NFS COPY requests. A remote attacker can submit an asynchronous COPY request to cause a denial of service.

Exploitation requires an IDR walker to dereference reused request memory whose contents resemble an expired NFS4_COPYNOTIFY_STID.

1780) Memory leak (CVE-ID: CVE-2026-89680)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in nfsd4_copy() when handling failed inter-server COPY operations. A remote attacker can trigger an inter-server COPY setup failure to cause a denial of service.

1781) Race condition (CVE-ID: CVE-2026-89684)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a race condition in the NFS server copy-notification state handling when processing concurrent NFSv4.2 OFFLOAD_CANCEL requests. A remote attacker can send racing OFFLOAD_CANCEL requests to cause a denial of service.

1782) Incorrect calculation (CVE-ID: CVE-2026-89685)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a clock domain mismatch in the NFS server clients_still_reclaiming() function when sending CLAIM_PREVIOUS OPEN requests. A remote attacker can send CLAIM_PREVIOUS OPEN requests to cause a denial of service.

1783) Race condition (CVE-ID: CVE-2026-89686)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a race condition in nfsd4_alloc_layout_stateid when concurrently revoking a delegation and processing a LAYOUTGET request. A remote attacker can send concurrent NFS requests that trigger delegation recall and layout-state allocation to cause a denial of service.

Exploitation requires one NFS client to hold a delegation and fail to respond to its recall while another client opens the same file.

1784) Use-after-free (CVE-ID: CVE-2026-89690)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to use-after-free in the NFS server's NFSv4 compound operation buffer handling when an rpc_status netlink dump reads operation numbers concurrently with NFSv4 compound request completion. A local user can initiate concurrent operations to trigger a use-after-free.

1785) Out-of-bounds read (CVE-ID: CVE-2026-89691)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose adjacent slab memory.

The vulnerability exists due to an out-of-bounds read in the RPC status dumpit handler when processing released NFSv4 compound arguments with a stale operation count. A local user can access the netlink status interface to disclose adjacent slab memory.

The exposure requires rq_status_counter to be stuck at an odd value.

1786) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-89693)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to create objects without the requested access control lists.

The vulnerability exists due to improper handling of ACL translation errors in nfsd4_create() when processing NFSv4 CREATE requests containing ACLs. A remote attacker can submit a crafted NFSv4 CREATE request that causes ACL translation to fail to create objects without the requested access control lists.

1787) Missing Authorization (CVE-ID: CVE-2026-89694)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper access control in the NFS server copy-notify state management function when processing OFFLOAD_CANCEL requests. A remote user can send an OFFLOAD_CANCEL request for another client's copy-notify stateid to cause a denial of service.

Copy-notify stateid object identifiers are allocated cyclically and are guessable.

1788) NULL pointer dereference (CVE-ID: CVE-2026-89696)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the NFS server compound request dispatch loop when processing a crafted NFSv4 COMPOUND request involving an inter-SSC COPY operation. A remote attacker can send a crafted NFSv4 COMPOUND request with an operation between a foreign PUTFH and SAVEFH to cause a denial of service.

Only systems with CONFIG_NFSD_V4_2_INTER_SSC enabled are affected.

1789) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-89697)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a SETATTR operation without a mount write reference.

The vulnerability exists due to missing mount write reference acquisition in nfsd_proc_setattr() when processing a SETATTR request in the BOTH_TIME_SET branch. A remote attacker can submit a SETATTR request with both time attributes set to perform a SETATTR operation without a mount write reference.

1790) Out-of-bounds read (CVE-ID: CVE-2026-89698)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in nfsd_genl_rpc_status_compose_msg() when handling IPv6 NFS client addresses. A local user can request RPC status information through the generic netlink interface to disclose sensitive information.

The IPv6 netlink address attributes can include rq_flags data in place of part of an IPv6 address.

1791) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-89699)

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled memory allocation in nfsd4_decode_create() when processing NFSv4 CREATE requests for symbolic links. A remote attacker can send crafted requests containing an oversized symbolic-link target length to cause a denial of service.

The allocation can persist until COMPOUND operation teardown.

1792) Out-of-bounds write (CVE-ID: CVE-2026-89702)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to write beyond a reserved trace ring-buffer slot or disclose prior ring-buffer contents.

The vulnerability exists due to an out-of-bounds write in the nfsd_fh_verify and nfsd_fh_verify_err tracepoints when processing NFSv2/v3-over-UDP requests. A remote attacker can send an NFS/UDP request to write a server socket address into a zero-byte trace ring-buffer slot.

When the local server address is shorter than the remote address, unwritten bytes in the oversized slot can be exposed to trace consumers.

1793) Race condition (CVE-ID: CVE-2026-89704)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause silent data loss.

The vulnerability exists due to a race condition in _nfsd_copy_file_range() when processing asynchronous NFS COPY operations. A remote user can issue concurrent COPY and COMMIT or stable WRITE operations to cause silent data loss.

1794) Improper handling of exceptional conditions (CVE-ID: CVE-2026-89706)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause copied data to be silently lost.

The vulnerability exists due to improper handling of writeback errors in the NFS server async COPY operation in _nfsd_copy_file_range() when processing an asynchronous COPY request whose writeback fails. A remote attacker can issue an asynchronous COPY request that encounters a writeback failure to cause copied data to be silently lost.

1795) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-89707)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper resource release in nfsd_cross_mnt() when handling NFS requests that result in follow_down() errors. A remote user can send NFS requests that trigger failed cross-mount operations to cause a denial of service.

The issue is reachable through nfsd_lookup_dentry or NFSv4 READDIR encoding.

1796) Use-after-free (CVE-ID: CVE-2026-89708)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to use-after-free in the NFS server callback session handling when terminating an NFSv4 session while a callback RPC task remains in flight. A remote user can send a DESTROY_SESSION request while a callback RPC task remains in flight to cause a denial of service.

1797) Memory leak (CVE-ID: CVE-2026-89710)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a memory leak.

The vulnerability exists due to improper resource cleanup in pnfs_layout_process() in the NFSv4.1 pNFS implementation when processing a new layout stateid returned while a valid stateid is still held. A remote attacker can operate an NFSv4.1 server that returns a new layout stateid to cause a memory leak.

1798) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-89711)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a kernel warning.

The vulnerability exists due to an incorrect warning condition in nfsd_mode_check when processing NFS client LOOKUP requests for exported NFS filesystems that lack a lookup method. A remote attacker can issue a LOOKUP request to trigger a kernel warning.

The condition can occur when reexporting an NFS filesystem.

1799) Use-after-free (CVE-ID: CVE-2026-89712)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in nfsd4_ssc_expire_umount() when processing concurrent NFS server operations while an expired inter-server source mount is being unmounted. A remote attacker can trigger concurrent operations that cause the expiration walk to dereference a freed nfsd4_ssc_umount_item to cause a denial of service.

1800) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-89713)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to truncate append-only files.

The vulnerability exists due to a time-of-check to time-of-use race condition in nfsd_setattr() when handling SETATTR size updates for append-only files. A remote user can issue a SETATTR request that races with a concurrent append to truncate append-only files.

1801) NULL pointer dereference (CVE-ID: CVE-2026-89717)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the zram compression algorithm handling when querying the compression algorithm after compressors have been reset. A local user can query the compression algorithm to cause a denial of service.

1802) Memory corruption (CVE-ID: CVE-2026-89718)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to access slots outside of table bounds.

The vulnerability exists due to improper synchronization in writeback_store() when a device is reset and reconfigured with a smaller disksize while writeback_store() is waiting to acquire dev_lock. A local privileged user can reset and reconfigure the device with a smaller disksize during the lock acquisition to access slots outside of table bounds.

1803) Race condition (CVE-ID: CVE-2026-89719)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds access.

The vulnerability exists due to a race condition in read_block_state() when reading block state information while a zram device is reset and reinitialized with a smaller disk size. A local user can read block state information during this condition to perform an out-of-bounds access.

1804) Out-of-bounds read (CVE-ID: CVE-2026-89720)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read beyond allocated memory.

The vulnerability exists due to an out-of-bounds read in ubifs_sb_verify_signature() when mounting a crafted signed UBIFS image. A local user can provide an image with an inflated signature length to read beyond allocated memory.

The signature is processed before it is cryptographically checked.

1805) Out-of-bounds read (CVE-ID: CVE-2026-89723)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds memory access.

The vulnerability exists due to improper deletion of an intermediate B-tree node in the NILFS2 block mapping implementation when truncating a file causes a B-tree mapping to collapse into a direct mapping. A local user can truncate a file to cause a residual B-tree node to be processed as a direct mapping entry and trigger an out-of-bounds memory access.

The residual node remains dirty in the B-tree node cache and can subsequently be processed by the log writer.

1806) Out-of-bounds write (CVE-ID: CVE-2026-89724)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt adjacent kernel heap memory.

The vulnerability exists due to an out-of-bounds write in the vicodec FWHT encoder when encoding a four-component pixel format whose planes take the unencoded fallback. A local user can submit a crafted frame to corrupt adjacent kernel heap memory.

1807) Out-of-bounds write (CVE-ID: CVE-2026-89725)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.2 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to write peer-controlled bytes out of bounds into surrounding memory.

The vulnerability exists due to an out-of-bounds write in stm32_rx_done() in the STM32 CEC driver when processing an overlong CEC message from a peer. A remote attacker can send a CEC message without ending it to write peer-controlled bytes out of bounds into surrounding memory.

The driver must be probed and receiving must be enabled.

1808) Out-of-bounds read (CVE-ID: CVE-2026-89726)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read memory beyond the specified length.

The vulnerability exists due to an off-by-one out-of-bounds read in ucs2_strnlen() in lib/ucs2_string.c when processing a UCS-2 string that is not NUL-terminated within the caller-provided maximum length. A local user can supply a non-NUL-terminated UCS-2 string to read memory beyond the specified length.

1809) Out-of-bounds write (CVE-ID: CVE-2026-89729)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause an out-of-bounds write.

The vulnerability exists due to an out-of-bounds write in sensor_hub_get_feature() when processing a malicious HID descriptor. An attacker with physical access can provide a HID descriptor advertising a large feature field size to cause an out-of-bounds write.

An IIO caller supplying a small stack buffer can be affected.

1810) Out-of-bounds read (CVE-ID: CVE-2026-89730)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in altera_cvp_send_block() in the Altera CvP FPGA driver when processing an input buffer with one to three trailing bytes. A local user can provide a crafted FPGA image with trailing bytes to cause a denial of service.

1811) Out-of-bounds read (CVE-ID: CVE-2026-89731)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read.

The vulnerability exists due to improper bounds checking in cxl_rch_get_aer_info() when copying AER capability registers from the RCRB MMIO block. A local user can trigger retrieval of AER information to cause an out-of-bounds read.

1812) Deadlock (CVE-ID: CVE-2026-89732)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock in ffs_ep0_read() in the FunctionFS USB gadget function when a userspace daemon repeatedly reads ep0 while the gadget is asynchronously torn down via configfs. A local user can repeatedly read ep0 during asynchronous gadget teardown to cause a denial of service.

1813) Use-after-free (CVE-ID: CVE-2026-89733)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access freed memory.

The vulnerability exists due to use-after-free in the UVC gadget function cleanup paths when handling bind errors or unbinding the function. A local user can trigger the affected cleanup paths to access freed memory.

1814) Memory leak (CVE-ID: CVE-2026-89735)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to improper resource cleanup in the Linux kernel MIDI 2 USB gadget function's configfs default groups when tearing down function instances or cleaning up endpoint options. A local user can tear down a MIDI 2 gadget function instance or clean up endpoint options to cause a memory leak.

1815) Use-after-free (CVE-ID: CVE-2026-89736)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to use-after-free in the USB gadget u_audio sound card cleanup handling when accessing or closing open ALSA control file descriptors after sound card teardown is initiated. A local user can access or close open ALSA control file descriptors to cause memory corruption.

ALSA control callbacks can dereference private data associated with a freed sound card context.

1816) Use-after-free (CVE-ID: CVE-2026-89738)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the at91 UDC driver's polled-VBUS timer and work cycle when removing the driver while a timer callback or work item is pending or running. A local user can unbind the driver while a timer callback or work item is pending or running to cause a denial of service.

Only systems configured to use polled-VBUS mode are affected.

1817) Use-after-free (CVE-ID: CVE-2026-89740)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to a use-after-free in the i.MX UART driver imx_uart_ports[] table when concurrent UART probe and removal operations occur. A local user can trigger sibling UART operations to trigger a use-after-free condition.

1818) Double free (CVE-ID: CVE-2026-89741)

CWE-ID: CWE-415 - Double Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a double-free condition.

The vulnerability exists due to a double free in __video_register_device() when handling a device_register() failure. A local user can trigger a device registration failure to cause a double-free condition.

1819) Use-after-free (CVE-ID: CVE-2026-89742)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in dma_req_free() when freeing DMA requests through the RapidIO mport character device interface. A local user can trigger the release of a mapping whose final reference is dropped and subsequently unlock a mutex through the freed mapping to cause a denial of service.

1820) Out-of-bounds read (CVE-ID: CVE-2026-89743)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose kernel heap memory.

The vulnerability exists due to an out-of-bounds read in the NSM response-processing path when processing a response length reported by an NSM device backend that exceeds the response buffer. A local user can trigger processing of an oversized reported response length to disclose kernel heap memory.

1821) Infinite loop (CVE-ID: CVE-2026-89744)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an infinite loop in fwnode_get_next_child_node() when iterating over children of a fwnode with a secondary fwnode that has more than one child. A local user can trigger the child-node iteration to cause a denial of service.

1822) Use-after-free (CVE-ID: CVE-2026-89746)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Linux kernel trace event histogram trigger handling when a hist trigger references a variable after same-name named triggers have been registered. A local user can write crafted hist triggers to tracefs to cause a denial of service.

1823) Use-after-free (CVE-ID: CVE-2026-89747)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the trace_pipe read path when changing the ring buffer sub-buffer order while an event is being processed. A local user can change the sub-buffer order while a trace_pipe reader is dereferencing a peeked event to cause a denial of service.

1824) Unchecked Return Value (CVE-ID: CVE-2026-89749)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an unchecked return value in event_test_stuff() when kthread creation fails. A local user can trigger a kthread creation failure that results in an error pointer being passed to kthread_stop() to cause a denial of service.

The failure can occur under memory pressure during the boot-time event self-test.

1825) Use-after-free (CVE-ID: CVE-2026-89750)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to improper reference count handling in the tracing user-events user_event_mm_dup() function when allocating tracing state during task duplication fails. A local user can fork a process to trigger a use-after-free condition.

1826) Off-by-one (CVE-ID: CVE-2026-89751)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect port I/O handling.

The vulnerability exists due to an off-by-one error in handle_in() and handle_out() in arch/x86/coco/tdx/tdx.c when emulating port I/O operations. A local user can perform port I/O operations that invoke the affected handlers to cause incorrect port I/O handling.

1827) Race condition (CVE-ID: CVE-2026-89752)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the memory.high and memory.max limit update handlers when concurrently updating memory cgroup limits through separate open files. A local user can lower a memory.max limit and restore it through another open file to cause a denial of service.

Exploitation requires a cgroup populated with anonymous memory and swapping disabled.

1828) Improper locking (CVE-ID: CVE-2026-89753)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause RCU Tasks stalls.

The vulnerability exists due to improper RCU quiescent-state handling in shrink_lruvec() in mm/vmscan.c when performing direct memory reclaim. A local user can trigger direct memory reclaim to cause RCU Tasks stalls.

The issue occurs on PREEMPTION kernels, where cond_resched() does not report a Tasks-RCU quiescent state.

1829) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-89755)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to stale mapping use in __migrate_device_pages() when migrating device pages after freeing swapcache. A local user can trigger device-page migration involving a folio removed from the swap cache to cause a denial of service.

The issue can occur after a large folio is split into order-0 folios.

1830) Improper locking (CVE-ID: CVE-2026-89756)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in migrate_pages_batch() when migrating large batches of folios. A local user can trigger a large batch of folio migrations to cause a denial of service.

On KVM hosts, MMU notifier invalidation callbacks can cause migration batches to run for an extended period.

1831) Resource exhaustion (CVE-ID: CVE-2026-89759)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the kmemleak task stack scanning routine when scanning task stacks on a host with very many threads. A local user can initiate a kmemleak scan that processes task stacks without rescheduling to cause a denial of service.

Task stack scanning must be enabled.

1832) Out-of-bounds write (CVE-ID: CVE-2026-89761)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in the AppArmor label vector setup used by aa_label_strn_parse() when parsing label names containing multiple "//&"-separated components. A local user can supply a crafted label name to cause memory corruption.

Every label component must resolve to a loaded profile.

1833) Use-after-free (CVE-ID: CVE-2026-89762)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in AppArmor credential handling when replacing stale labels while the task uses overridden credentials. A local user can cause stale-label replacement while using overridden credentials to trigger a use-after-free condition.

1834) Use-after-free (CVE-ID: CVE-2026-89763)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the trusted TPM key type teardown routine when a trusted key operation races with module teardown. A local user can trigger a race between a trusted key operation and module teardown to cause a denial of service.

1835) Use of Uninitialized Variable (CVE-ID: CVE-2026-89765)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose uninitialized kernel stack memory.

The vulnerability exists due to use of uninitialized memory in put_itimerval() when calling getitimer() on native sparc64 systems. A remote attacker can invoke getitimer() to disclose uninitialized kernel stack memory.

1836) Race condition (CVE-ID: CVE-2026-89771)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a race condition during ring buffer reads.

The vulnerability exists due to a race condition in Linux kernel ring buffer reader operations when concurrently resizing ring buffer subbuffers and reading ring buffer pages. A local user can invoke concurrent subbuffer resizing and ring buffer read operations to trigger a race condition during ring buffer reads.

1837) Use-after-free (CVE-ID: CVE-2026-89774)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to a use-after-free in the Bluetooth SCO socket connection handling code when handling SCO connection-ready events concurrently with socket closure. A remote attacker can trigger a race between connection setup and socket release to compromise confidentiality, integrity, and availability.

1838) Out-of-bounds read (CVE-ID: CVE-2026-89776)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose kernel memory.

The vulnerability exists due to an out-of-bounds read in the VXLAN VNI filter entry policy when processing short GROUP or GROUP6 netlink attributes. A remote attacker can submit specially crafted netlink attributes to disclose kernel memory.

The over-read bytes are stored in remote_ip and returned through RTM_GETTUNNEL.

1839) Use-after-free (CVE-ID: CVE-2026-89777)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise system confidentiality, integrity, and availability.

The vulnerability exists due to use-after-free caused by a dangling pointer in vfio pci MSI permission-table handling when MSI permission-table initialization fails. A local user can cause MSI permission-table initialization to fail and subsequently access MSI configuration to compromise system confidentiality, integrity, and availability.

The per-device structure persists across open and close cycles.

1840) Out-of-bounds read (CVE-ID: CVE-2026-89778)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read memory out of bounds.

The vulnerability exists due to an out-of-bounds read in zisofs_fill_pages() when reading a compressed file on a mounted ISO9660 image containing a crafted ZF Rock Ridge record. A remote attacker can provide a crafted ISO9660 image to read memory out of bounds.

The issue is triggered when an empty zisofs block follows a sub-page block with a nonzero page offset.

1841) Out-of-bounds read (CVE-ID: CVE-2026-89779)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper bounds validation in the NTFS3 extended-attribute record parser when processing a crafted NTFS image. A remote attacker can provide an extended-attribute record with an undersized size field to disclose sensitive information.

1842) NULL pointer dereference (CVE-ID: CVE-2026-89780)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in rmnet_map_deaggregate() when processing an aggregated frame containing a flow-control command. A local user can write a crafted aggregated frame to a tap device file descriptor to cause a denial of service.

Exploitation requires an rmnet link over a tap device with ingress deaggregation and ingress MAP commands enabled.

1843) Out-of-bounds read (CVE-ID: CVE-2026-89781)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to improper validation of an on-disk offset in read_log_rec_buf() when mounting a crafted NTFS image. A remote attacker can mount a crafted NTFS image to compromise confidentiality, integrity, and availability.

1844) Numeric Truncation Error (CVE-ID: CVE-2026-89782)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an out-of-bounds memory access.

The vulnerability exists due to integer truncation in the NTFS3 restart table handling in fs/ntfs3/fslog.c when replaying a crafted NTFS $LogFile. A remote attacker can mount a crafted NTFS image to cause an out-of-bounds memory access.

1845) Out-of-bounds write (CVE-ID: CVE-2026-89783)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to an out-of-bounds write in xfrm6_input_addr() when processing an inner IPv6 packet containing a destination-options HAO option or a type-2 routing header. A remote attacker can send a specially crafted packet to compromise confidentiality, integrity, and availability.

Exploitation requires the transport-mode receive path to re-enter IPv6 input with a secpath whose length is at the maximum depth.

1846) NULL pointer dereference (CVE-ID: CVE-2026-89784)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in rpcb_register_inet4() and rpcb_register_inet6() when an in-kernel RPC service registers with the local rpcbind after an address-string allocation fails. A local user can cause an in-kernel RPC service to register with the local rpcbind to cause a denial of service.

Exploitation requires sufficient memory pressure for a small GFP_KERNEL allocation to fail.

1847) Out-of-bounds read (CVE-ID: CVE-2026-89785)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to read beyond the allocated buffer.

The vulnerability exists due to an out-of-bounds read in ntfs_reparse_init() and ntfs_objid_init() when mounting a crafted NTFS filesystem image containing a malformed resident INDEX_ROOT attribute. A local privileged user can mount a crafted filesystem image to read beyond the allocated buffer.

Exploitation requires CAP_SYS_ADMIN.

1848) Out-of-bounds read (CVE-ID: CVE-2026-89786)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information and cause a denial of service.

The vulnerability exists due to an out-of-bounds read in ext4_read_inline_dir() when processing inline directory entries during getdents64() calls. A remote attacker can cause the kernel to process an inline directory entry whose header extends beyond the inline buffer to disclose sensitive information and cause a denial of service.

1849) Out-of-bounds read (CVE-ID: CVE-2026-89787)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in ext4_search_dir() when processing a crafted directory entry during a directory lookup. A local user can provide a crafted directory entry to read out-of-bounds memory.

The issue affects casefolded encrypted directories that store hash values in directory entries on the sb_no_casefold_compat_fallback() path.

1850) Use-after-free (CVE-ID: CVE-2026-89789)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose and modify sensitive information and cause a denial of service.

The vulnerability exists due to use-after-free in the gtp_newlink() error path in drivers/net/gtp.c when handling gtp_newlink() error paths concurrently with gtp encapsulation receive operations. A local user can trigger the race condition to disclose and modify sensitive information and cause a denial of service.

1851) Out-of-bounds read (CVE-ID: CVE-2026-89792)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information and cause a denial of service.

The vulnerability exists due to out-of-bounds read in the ksmbd share configuration response handling when processing IPC share configuration responses with malformed variable-length fields. A local user can provide a crafted share configuration response to disclose sensitive information and cause a denial of service.

1852) Improper access control (CVE-ID: CVE-2026-89793)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel-written command-buffer fields.

The vulnerability exists due to improper access control in ublk_ch_mmap() when upgrading a read-only ublk character-device mapping with mprotect(). A local user can change the mapping to writable and modify per-queue command-buffer entries to corrupt kernel-written command-buffer fields.

1853) Out-of-bounds read (CVE-ID: CVE-2026-89794)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose uninitialized kernel heap memory.

The vulnerability exists due to an out-of-bounds read in the ksmbd smb2_read_pipe() function when handling compound SMB pipe read responses. A remote attacker can issue an SMB pipe read request that causes alignment padding to be included in a response to disclose uninitialized kernel heap memory.

1854) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-89795)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to reset an unintended PCI function and leak memory.

The vulnerability exists due to improper PCI slot assignment in the s390 PCI hotplug slot handling when requesting a function reset through the hotplug driver's slot_reset interface. A local user can request a reset for a PCI function to reset an unintended function and leak memory.

This occurs on s390 systems that expose the topology of multifunction PCI devices in a shared PCI domain.

1855) Integer overflow (CVE-ID: CVE-2026-89796)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in kdamond_merge_regions() in the DAMON core when merging DAMON regions after online parameter updates. A local user can configure DAMON with an excessively large aggregation interval and numerous non-contiguous regions to cause a denial of service.

Exploitation requires the region count to remain above the user-defined upper limit after aggressive merging.

1856) Use-after-free (CVE-ID: CVE-2026-89797)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to a use-after-free in the ab8500 fuel-gauge driver workqueue teardown when a threaded interrupt handler fires during driver removal. A local user can cause a threaded interrupt handler to queue work on a freed workqueue to trigger a use-after-free condition.

Threaded interrupt handlers remain armed until driver removal returns.

1857) Race condition (CVE-ID: CVE-2026-89799)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to improper synchronization in bpf_get_stackid when accessing the trace entries buffer returned by get_perf_callchain. A local user can invoke bpf_get_stackid to compromise confidentiality, integrity, and availability.

1858) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-89800)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the nouveau UVMM bind-job unwind handling when a later operation in a bind job fails after a successful sparse unmap. A local user can cause a later operation in a bind job to fail after a successful sparse unmap to cause a denial of service.

1859) Use-after-free (CVE-ID: CVE-2026-89801)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to a use-after-free in the OP_UNMAP_SPARSE arm of nouveau_uvmm_bind_job_submit() when handling failed sparse unmap operations. A local user can submit a sparse unmap operation to compromise confidentiality, integrity, and availability.

1860) NULL pointer dereference (CVE-ID: CVE-2026-89802)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the reverse unwind loop of nouveau_uvmm_bind_job_submit() when processing a bind job containing a successful sparse mapping operation followed by a later failing operation. A local user can submit a crafted bind job to cause a denial of service.

1861) Use-after-free (CVE-ID: CVE-2026-89803)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in the Nouveau channel teardown handler when a channel-kill event is delivered during channel destruction. A local user can trigger a channel-kill event during the teardown window to execute arbitrary code.

The issue affects Fermi and newer GPUs; the kill event must occur while the channel is being destroyed.

1862) Integer overflow (CVE-ID: CVE-2026-89806)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code, disclose sensitive information, or cause a denial of service.

The vulnerability exists due to an integer overflow in the framebuffer size calculation in drm/sysfb/ofdrm.c when creating an ofdrm device with large linebytes and height values. A remote attacker can provide values that cause the framebuffer size calculation to overflow to execute arbitrary code, disclose sensitive information, or cause a denial of service.

1863) Improper update of reference count (CVE-ID: CVE-2026-89816)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to improper reference counting in complete_signaling() in the DRM atomic UAPI when an atomic DRM ioctl using DRM_MODE_PAGE_FLIP_EVENT is blocked while waiting for fences. A local user can issue the atomic DRM ioctl with a sw_sync fence and send a signal to the blocked thread to cause a memory leak.

The condition was observed with amdgpu and vkms.

1864) Improper Null Termination (CVE-ID: CVE-2026-89817)

CWE-ID: CWE-170 - Improper Null Termination

CVSSv4: 0 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to perform an out-of-bounds read.

The vulnerability exists due to improper null termination in gud_connector_add_tv_mode() when processing TV mode names received from a USB device. An attacker with physical access can provide TV mode names that are not NUL-terminated to perform an out-of-bounds read.

1865) Integer overflow (CVE-ID: CVE-2026-89818)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information and cause a denial of service.

The vulnerability exists due to an integer overflow in the AMDGPU VCN message parser when processing a VCN message with an oversized buffer count. A local user can submit a specially crafted VCN message to disclose sensitive information and cause a denial of service.

Triggering the issue additionally requires an approximately 4 GiB mapping.

1866) Out-of-bounds read (CVE-ID: CVE-2026-89819)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the AMD display plane degamma LUT handling when processing a malformed AMD_PLANE_DEGAMMA_LUT property blob. A local user can set a malformed plane degamma LUT to cause a denial of service or disclose sensitive information.

The AMD_PLANE_DEGAMMA_LUT property is exposed only in builds with AMD_PRIVATE_COLOR defined.

1867) Division by zero (CVE-ID: CVE-2026-89821)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a divide-by-zero error in the __is_lut_linear() function when processing a single-entry lookup table. A local user can trigger processing of a single-entry lookup table to cause a denial of service.

1868) NULL pointer dereference (CVE-ID: CVE-2026-89822)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in i915_pci_probe() when a device is force-bound through the sysfs driver_override interface. A local user can force-bind a device to the i915 driver to cause a denial of service.

1869) Race condition (CVE-ID: CVE-2026-89823)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to a race condition in drm_dev_register() error handling when a partially registered DRM minor is opened and an ioctl is processed. A local user can open the registered minor and issue an ioctl while device resources are being torn down to compromise confidentiality, integrity, and availability.

1870) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-89824)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a resource leak.

The vulnerability exists due to a missing release of an i2c adapter reference in the drm/panel-edp panel driver when handling probe failures or driver unbinding with a devicetree ddc-i2c-bus property referring to the auxiliary ddc bus. A local privileged user can cause a panel driver probe failure or unbind to cause a resource leak.

1871) Use of uninitialized resource (CVE-ID: CVE-2026-89827)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use of an uninitialized resource in the AMDGPU UVD decode ring fence driver when restoring the fence sequence during UVD resume on an SR-IOV virtual function. A local user can trigger UVD resume to cause a denial of service.

1872) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-89830)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a permanent leak of valid block counts.

The vulnerability exists due to improper error handling in __allocate_data_block() when a new data block allocation fails. A local user can trigger a data block allocation failure to cause a permanent leak of valid block counts.

The leaked accounting affects total_valid_block_count and i_blocks.

1873) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-89832)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to persist inconsistent node data to storage.

The vulnerability exists due to improper error handling in the f2fs node folio error path when processing a node block with a checksum mismatch or inconsistent footer information. A local user can trigger error handling for a corrupted node block to persist inconsistent node data to storage.

1874) Out-of-bounds write (CVE-ID: CVE-2026-89834)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform out-of-bounds I/O.

The vulnerability exists due to incomplete iteration over active curseg types in free_segment_range() when shrinking an F2FS filesystem. A local user can initiate a filesystem shrink operation while active in-memory curseg types reside in the target range to perform out-of-bounds I/O.

Non-persistent in-memory curseg types, including CURSEG_COLD_DATA_PINNED and CURSEG_ALL_DATA_ATGC, can remain in the truncated range.

1875) NULL pointer dereference (CVE-ID: CVE-2026-89835)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the f2fs ckpt_thread_ioprio sysfs store path when writing the checkpoint thread I/O priority through sysfs while checkpoint merge is enabled and no checkpoint thread is running. A local user can write a checkpoint thread I/O priority value through sysfs to cause a denial of service.

A read-only mount is one condition in which no checkpoint merge thread is started.

1876) Memory leak (CVE-ID: CVE-2026-89837)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a missing release of a folio reference in find_in_level() in the f2fs directory-handling code when handling an error returned by find_in_block(). A local user can perform directory lookups that encounter find_in_block() errors to cause a denial of service.

1877) Out-of-bounds read (CVE-ID: CVE-2026-89838)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in F2FS recovery filename logging when logging a 255-byte recovery filename. A local user can cause recovery logging of a 255-byte filename to disclose sensitive information.

1878) Incorrect authorization (CVE-ID: CVE-2026-89839)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to modify the system.advise extended attribute without proper authorization.

The vulnerability exists due to improper authorization in f2fs_xattr_advise_set() when setting the system.advise extended attribute through an idmapped f2fs mount. A local user can attempt to set the system.advise extended attribute to modify the system.advise extended attribute without proper authorization.

1879) Integer overflow (CVE-ID: CVE-2026-89840)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause data corruption and a denial of service.

The vulnerability exists due to an integer overflow in the F2FS F2FS_IOC_MOVE_RANGE operation when moving a range with unchecked destination offsets. A local user can invoke the operation with crafted range offsets to cause data corruption and a denial of service.

A source hole can cause the block-cloning operation to succeed while extending the destination inode using an unchecked destination end position.

1880) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-89842)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an unintended firmware doorbell write.

The vulnerability exists due to improper firmware state validation in qla_nvme_xmt_ls_rsp and qla2xxx_process_purls_pkt when handling NVMe LS responses or PURLS packets while firmware is stopped or resetting. A local user can cause an LS reject IOCB to be emitted to trigger an unintended firmware doorbell write.

1881) Use of uninitialized resource (CVE-ID: CVE-2026-89843)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of uninitialized stack memory in qla2xxx BSG handlers when processing a short user-supplied BSG request payload. A local user can submit a specially crafted short BSG request to disclose sensitive information.

The information leak occurs in qla2x00_read_fru_status() and qla2x00_read_i2c().

1882) Race condition (CVE-ID: CVE-2026-89844)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt host map data.

The vulnerability exists due to improper locking in qla24xx_report_id_acquisition() in the qla2xxx SCSI driver when processing format-1 report ID acquisition. A remote attacker can trigger concurrent host map updates to corrupt host map data.

1883) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-89845)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a time-of-check to time-of-use race condition in qla2x00_error_entry() when handling error entries during request-queue teardown. A local user can trigger processing of an error entry while the request queue is being torn down to cause a denial of service.

The response-queue interrupt can remain registered while request queues are being torn down.

1884) Out-of-bounds read (CVE-ID: CVE-2026-89846)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in qla2x00_status_entry() in the qla2xxx SCSI driver when processing an FCP response containing an oversized response information length. A remote attacker can send a crafted FCP response with an oversized rsp_info_len value to disclose sensitive information.

1885) Use-after-free (CVE-ID: CVE-2026-89847)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to a use-after-free in qla2x00_async_iocb_timeout() in the qla2xxx SCSI driver when an async IOCB timeout races with response interrupt completion. A remote attacker can trigger the race condition to compromise confidentiality, integrity, and availability.

1886) Use-after-free (CVE-ID: CVE-2026-89848)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to use-after-free in the qla2xxx request queue handling when processing response-queue interrupts during queue teardown. A remote attacker can trigger a late response completion during queue teardown to compromise confidentiality, integrity, and availability.

1887) Type Confusion (CVE-ID: CVE-2026-89849)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a wild pointer dereference.

The vulnerability exists due to type confusion in the qla2x00_status_entry() SCSI fast path when processing an unexpected STATUS_TYPE IOCB for a non-SCSI handle. A remote attacker can cause an unexpected STATUS_TYPE IOCB for a non-SCSI handle to be processed to cause a wild pointer dereference.

1888) Improper locking (CVE-ID: CVE-2026-89850)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in qla2x00_fw_state_show() when querying firmware state while the chip is down or EEH is busy. A local user can query the firmware state to cause a denial of service.

1889) NULL pointer dereference (CVE-ID: CVE-2026-89851)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in qla2x00_dfs_fce_write() when parsing a value written to the debugfs FCE trace interface. A local user can write a valid numeric value to the interface to cause a denial of service.

Invalid values can unintentionally enable FCE tracing.

1890) Use of Uninitialized Variable (CVE-ID: CVE-2026-89852)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of an uninitialized variable in qla2x00_get_firmware_state() when querying firmware state through sysfs during a mailbox command failure. A local user can read firmware state through the fw_state or mpi_fw_state sysfs handlers during such a failure to disclose sensitive information.

1891) Use-after-free (CVE-ID: CVE-2026-89853)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to a race condition in qla2xxx FCE trace buffer handling when a debugfs FCE disable occurs during firmware dump processing. A local user can disable FCE tracing through debugfs during a firmware dump to trigger a use-after-free.

1892) Use-after-free (CVE-ID: CVE-2026-89854)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to a use-after-free in the qla2xxx driver's 84xx_fw_version sysfs attribute handler when concurrently reading the attribute during host teardown. A local user can read the 84xx_fw_version sysfs attribute during host teardown to compromise confidentiality, integrity, and availability.

1893) Race condition (CVE-ID: CVE-2026-89855)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause corruption of flash version reads.

The vulnerability exists due to improper synchronization in the qla2x00_sysfs_write_reset reset handler when the update cache versions without reset sysfs reset operation is invoked concurrently with a VPD or optrom flash operation. A local user can invoke the reset operation while a concurrent flash operation accesses the same hardware flash registers to cause corruption of flash version reads.

1894) Numeric Truncation Error (CVE-ID: CVE-2026-89856)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory or cause a denial of service.

The vulnerability exists due to numeric truncation in the qla2xxx MSI-X queue-count calculation when deriving queue counts from MSI-X vector counts. A remote attacker can cause a zero queue count to be used for queue allocation to corrupt memory or cause a denial of service.

Target mode can also underflow the queue count after decrementing it.

1895) Improper locking (CVE-ID: CVE-2026-89857)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause duplicated or dropped commands.

The vulnerability exists due to improper locking in the qla_nvme_ls_reject_iocb() request-ring handling when processing NVMe-FC link-service error responses and purex packets. A remote attacker can send NVMe-FC link-service traffic that triggers concurrent request-ring operations to cause duplicated or dropped commands.

1896) Out-of-bounds read (CVE-ID: CVE-2026-89858)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose kernel stack memory to a device.

The vulnerability exists due to an out-of-bounds read in qla2x00_update_fru_versions() when processing BSG requests with an oversized declared image count. A local user can submit a crafted BSG request to disclose kernel stack memory to a device.

1897) Use of uninitialized resource (CVE-ID: CVE-2026-89859)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of uninitialized memory in qla2x00_do_dport_diagnostics() when handling dport diagnostic requests. A local user can submit a dport diagnostic request with a partial payload to disclose sensitive information.

1898) Race condition (CVE-ID: CVE-2026-89860)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt workqueue state, causing system crashes or a looping worker.

The vulnerability exists due to a race condition in the qla2xxx NVMe abort work handling when multiple aborts are issued for the same command while its abort work item is queued. A remote attacker can trigger repeated aborts for the same command to corrupt workqueue state, causing system crashes or a looping worker.

1899) Use-after-free (CVE-ID: CVE-2026-89861)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to use-after-free in qla24xx_report_id_acquisition() in the qla2xxx SCSI driver when a virtual port is concurrently deallocated after it is found in the virtual port list. A remote attacker can trigger the race condition to compromise confidentiality, integrity, and availability.

1900) NULL pointer dereference (CVE-ID: CVE-2026-89863)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in qla_chk_edif_rx_sa_delete_pending() when processing a firmware status completion for a command that has already been returned or aborted. A remote attacker can trigger processing of such a status completion to cause a denial of service.

The kernel crash occurs in interrupt context.

1901) Out-of-bounds write (CVE-ID: CVE-2026-89864)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to corrupt kernel heap and stack memory.

The vulnerability exists due to improper bounds checking in the qla2x00_write_i2c() and qla2x00_read_i2c() I2C BSG handlers when processing a user-supplied I2C length. A local privileged user can submit a crafted I2C BSG request with an oversized length to corrupt kernel heap and stack memory.

Exploitation requires CAP_SYS_RAWIO.

1902) Use of uninitialized resource (CVE-ID: CVE-2026-89865)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information and modify device flash contents.

The vulnerability exists due to use of uninitialized memory in the qla2xxx FRU and I2C BSG handlers when processing a user-controlled payload that overrides the transfer length. A local user can send a crafted BSG request to disclose sensitive information and modify device flash contents.

1903) Infinite loop (CVE-ID: CVE-2026-89868)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an infinite loop in the wave5_vpu_dec_stop_streaming function when stopping media streaming. A local user can trigger the stop_streaming operation to cause a denial of service.

1904) Double free (CVE-ID: CVE-2026-89870)

CWE-ID: CWE-415 - Double Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to a double free in zoran_exit_video_devices() when unregistering a registered video device during device teardown. A local user can trigger device teardown to cause memory corruption.

1905) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-89871)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in the video-i2c driver's streaming functions when a capture-thread startup fails. A local user can invoke streaming operations after a capture-thread startup failure to cause a denial of service.

1906) Memory leak (CVE-ID: CVE-2026-89872)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak fwnode references.

The vulnerability exists due to a missing reference release in v4l2_fwnode_parse_link when parsing a link. A local user can trigger link parsing to leak fwnode references.

1907) NULL pointer dereference (CVE-ID: CVE-2026-89874)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in v4l2_async_match_notify() in the v4l2-async subsystem when ancillary media link creation fails. A local user can trigger ancillary media link creation failure to cause a denial of service.

1908) Integer overflow (CVE-ID: CVE-2026-89876)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger undefined behavior.

The vulnerability exists due to an integer overflow in the tda18250 media driver when exp equals zero. A local user can cause exp to equal zero to trigger undefined behavior.

1909) Use-after-free (CVE-ID: CVE-2026-89877)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a use-after-free condition.

The vulnerability exists due to a use-after-free in the saa7164_dev_setup() error path when PCI BAR memory-region allocation fails during device setup. A remote attacker can trigger the affected error path to cause a use-after-free condition.

1910) Out-of-bounds read (CVE-ID: CVE-2026-89878)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in s2255_probe() when processing a firmware blob shorter than eight bytes. A local user can supply a firmware blob shorter than eight bytes to read out-of-bounds memory.

1911) Out-of-bounds write (CVE-ID: CVE-2026-89879)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to write beyond the destination buffer.

The vulnerability exists due to an out-of-bounds write in the s2255_fillbuff() JPEG/MJPEG frame handling code when processing a device-supplied JPEG frame header. An attacker with physical access can provide a crafted frame header with an oversized jpg_size value to write beyond the destination buffer.

1912) Improper resource shutdown or release (CVE-ID: CVE-2026-89880)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to improper error-path resource cleanup in rtl2832_sdr_start_streaming() when starting streaming after a prior failed streaming attempt. A local user can initiate streaming again after a failed streaming attempt to compromise confidentiality, integrity, and availability.

The out-of-bounds access occurs during URB cleanup when urbs_initialized exceeds MAX_BULK_BUFS.

1913) Memory leak (CVE-ID: CVE-2026-89881)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by leaking DMA resources.

The vulnerability exists due to improper resource cleanup in the rtl2832_sdr driver removal handling when a USB device is disconnected while streaming remains active. A local user can close a file descriptor after the disconnection to cause a denial of service by leaking DMA resources.

1914) Improper resource shutdown or release (CVE-ID: CVE-2026-89883)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to improper resource cleanup in the sunxi-cir driver when probe initialization fails after rc device registration. A local user can trigger a probe failure to compromise confidentiality, integrity, and availability.

1915) NULL pointer dereference (CVE-ID: CVE-2026-89884)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a missing null pointer check in the mtk-mdp3 platform driver when initializing the driver before the SCP driver has been bound. A local user can cause the affected driver to initialize before the SCP driver is bound to cause a denial of service.

1916) Double free (CVE-ID: CVE-2026-89887)

CWE-ID: CWE-415 - Double Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a kernel panic.

The vulnerability exists due to improper resource lifecycle management in the ov7740_remove() function when removing the ov7740 driver. A local user can trigger driver removal to cause a kernel panic.

1917) Use-after-free (CVE-ID: CVE-2026-89888)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code, disclose sensitive information, modify data, or cause a denial of service.

The vulnerability exists due to use-after-free in the ov02a10_check_hwcfg() function of the ov02a10 media I2C driver when handling endpoint configuration. A local user can trigger hardware configuration checking to execute arbitrary code, disclose sensitive information, modify data, or cause a denial of service.

1918) Use-after-free (CVE-ID: CVE-2026-89890)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to use-after-free in go7007 ALSA PCM callbacks when a capture PCM remains open during V4L2 device release. A local user can retain an open capture PCM during V4L2 device release to compromise confidentiality, integrity, and availability.

1919) Use-after-free (CVE-ID: CVE-2026-89891)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.1 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to use-after-free in the em28xx device-list handling during extension closure when disconnecting a dual transport-stream device through the audio-only path. An attacker with physical access can connect a USB device with crafted endpoint descriptors to cause a denial of service.

1920) Use-after-free (CVE-ID: CVE-2026-89892)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to trigger a use-after-free.

The vulnerability exists due to improper device list management in the em28xx audio-only extension registration path when connecting and disconnecting a dual-TS board. An attacker with physical access can connect and disconnect a dual-TS board to trigger a use-after-free.

The condition affects audio-only paths on dual-TS boards.

1921) Use-after-free (CVE-ID: CVE-2026-89893)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read or modify sensitive information and cause a denial of service.

The vulnerability exists due to a use-after-free in the NetUP CI status work handling in drivers/media/pci/cx23885/cimax2.c when tearing down a NetUP CI device while CI status work is pending or running. A local user can trigger device teardown while the queued status worker can still access freed state to read or modify sensitive information and cause a denial of service.

1922) Out-of-bounds write (CVE-ID: CVE-2026-89894)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a heap-based out-of-bounds write.

The vulnerability exists due to a heap-based buffer overflow in cx231xx VBI buffer handling in cx231xx_do_vbi_copy() when changing video geometry while a VBI stream is running. A local user can allocate a small VBI buffer and change the video width or standard to write past the allocated buffer.

Exploitation requires the device to deliver a field-2 VBI payload.

1923) Double free (CVE-ID: CVE-2026-89895)

CWE-ID: CWE-415 - Double Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in the cobalt ALSA initialization error cleanup path when initializing cobalt ALSA support. A local user can cause cobalt_alsa_init() to fail after snd_cobalt_card_create() to cause a denial of service.

1924) Memory leak (CVE-ID: CVE-2026-89896)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in the V4L2 control handler in cedrus_init_ctrls() when allocation of ctx->ctrls fails. A local user can trigger the allocation failure path to cause a denial of service.

1925) Race condition (CVE-ID: CVE-2026-89897)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.7 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to a race condition in cec_receive_notify() when handling CEC messages concurrently with follower mode changes or release. A remote attacker can send CEC messages during concurrent follower mode changes or release to compromise confidentiality, integrity, and availability.

1926) Use-after-free (CVE-ID: CVE-2026-89899)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to a use-after-free race condition in cec_transmit_msg_fh in the CEC subsystem when a blocking transmit wait is interrupted by a signal. A local user can interrupt a blocking transmit wait with a signal to compromise confidentiality, integrity, and availability.

1927) Memory leak (CVE-ID: CVE-2026-89900)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to improper memory release in cec_unregister_adapter() when unregistering a CEC adapter. A local user can trigger CEC adapter unregistration to cause a memory leak.

1928) NULL pointer dereference (CVE-ID: CVE-2026-89901)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the Airspy USB driver when closing a streaming device after it has been disconnected. A local user can close the streaming device after disconnection to cause a denial of service.

1929) Integer underflow (CVE-ID: CVE-2026-89902)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass a BPF cgroup socket creation policy.

The vulnerability exists due to preempt count underflow in the LoongArch kprobe_singlestep_handler() function when processing an ordinary userspace breakpoint using code 11. A local user can issue a code 11 breakpoint and open a socket from a SIGTRAP handler to bypass a BPF cgroup socket creation policy.

The socket can be attributed to the root cgroup rather than the task's own cgroup.

1930) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-89903)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service and corrupt kernel state.

The vulnerability exists due to improper restoration of a stale per-CPU base register in the LoongArch rethook trampoline when a task migrates to another CPU during rethook trampoline handling. A local user can trigger task migration during rethook trampoline handling to cause a denial of service and corrupt kernel state.

1931) Improper initialization (CVE-ID: CVE-2026-89908)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to improper preservation of memslot architecture flags in the LoongArch KVM memory-region handling code when processing a KVM_MR_FLAGS_ONLY memory-region update. A local user can perform a KVM_MR_FLAGS_ONLY update to compromise confidentiality, integrity, and availability.

The issue occurs when guest physical and host virtual address offsets within a PMD differ.

1932) Memory leak (CVE-ID: CVE-2026-89909)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a resource leak.

The vulnerability exists due to improper cleanup in kvm_loongarch_init() when kvm_init() fails. A local user can trigger a kvm_init() failure to cause a resource leak.

1933) NULL pointer dereference (CVE-ID: CVE-2026-89912)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in vgic_its_save_ite() in the KVM arm64 vgic-its component when saving ITS tables during virtual machine migration after processing MAPD, MAPTI, and MAPC with V=0 commands. A remote attacker can issue MAPD, MAPTI, and MAPC commands with V=0 in a guest to cause a denial of service.

The command sequence is architecturally unpredictable.

1934) Use of Uninitialized Variable (CVE-ID: CVE-2026-89921)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of uninitialized stack data structures in __kvm_inject_pfault_token() when using migration ioctls after page-fault token injection. A local user can retrieve stale stack values to disclose sensitive information.

The stale values are not exposed to the guest through interrupt delivery.

1935) Use-after-free (CVE-ID: CVE-2026-89922)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information, modify data, or cause a denial of service.

The vulnerability exists due to improper synchronization in __import_wp_info() when importing watchpoint data during a concurrent memslot update. A local user can initiate watchpoint data import while a concurrent memslot update occurs to disclose sensitive information, modify data, or cause a denial of service.

1936) Memory leak (CVE-ID: CVE-2026-89923)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in KVM s390 vCPU destruction when destroying a vCPU while hardware breakpoints remain armed. A local user can destroy a vCPU with armed hardware breakpoints to cause a denial of service.

The leaked allocations are charged to memory cgroups and can pin dying memory cgroups.

1937) Memory leak (CVE-ID: CVE-2026-89924)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource cleanup in the s390 KVM guest debug watchpoint import error path when importing watchpoint data from a KVM_SET_GUEST_DEBUG request. A local user can submit a KVM_SET_GUEST_DEBUG request in which a later watchpoint fails to import to cause a denial of service.

The request can be repeated, leaking up to MAX_BP_COUNT - 1 buffers of up to MAX_WP_SIZE bytes per failed request.

1938) Memory leak (CVE-ID: CVE-2026-89925)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to missing release of memory in KVM s390 guest debug handling when successfully processing KVM_SET_GUEST_DEBUG requests. A local user can repeatedly issue successful KVM_SET_GUEST_DEBUG requests to cause a denial of service.

1939) Numeric Truncation Error (CVE-ID: CVE-2026-89926)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to numeric truncation in the KVM s390 __import_wp_info() function when importing user-supplied hardware breakpoint information. A local user can supply an oversized breakpoint length value to trigger a kernel warning.

1940) Integer overflow (CVE-ID: CVE-2026-89927)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer overflow in the KVM x86 Hyper-V synthetic timer deadline calculation when programming a synthetic timer with a count value close to U64_MAX. A remote attacker can program a synthetic timer with a crafted count value to cause a denial of service.

1941) Race condition (CVE-ID: CVE-2026-89929)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to improper synchronization of TLB invalidation in KVM nested virtualization INVVPID emulation when a virtual machine is migrated between physical CPUs. A local user can cause L1 to migrate between physical CPUs while emulating INVVPID to compromise confidentiality, integrity, and availability.

1942) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-89930)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause stale TLB translations to be used.

The vulnerability exists due to failure to service queued local TLB flush requests in KVM nVMX nested VM-entry handling when a nested VM entry fails after switching to the L2 context. A remote attacker can change L2's VPID and trigger a failed nested VM entry to cause stale TLB translations to be used.

1943) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-89931)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause vmcs12 pages to be double-mapped.

The vulnerability exists due to improper state management in KVM nVMX nested VM-Exit handling when emulating a nested VM-Exit. A local user can trigger a nested VM-Exit without the pending request being cleared to cause vmcs12 pages to be double-mapped.

The condition can occur if KVM exits VM-Enter without processing the request before emulating VMLAUNCH or VMRESUME.

1944) Improper initialization (CVE-ID: CVE-2026-89932)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose or modify sensitive information, or cause a denial of service.

The vulnerability exists due to improper initialization of last_vpid in KVM nested VMX VPID management when reusing a VPID after an L1 guest transitions from VMXOFF to VMXON and runs an L2 guest. A local user can cause stale TLB entries associated with a previous VPID lifetime to be used to disclose or modify sensitive information, or cause a denial of service.

1945) NULL pointer dereference (CVE-ID: CVE-2026-89933)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in dps310_probe() in the DPS310 pressure sensor driver when probing a device enumerated through its ACPI HID. A local user can trigger probing of the affected device to cause a denial of service.

1946) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-89934)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to prevent the device from autosuspending.

The vulnerability exists due to a runtime PM reference leak in ltrf216a_get_lux() when a sensor data read fails. A local user can trigger a failed sensor data read to prevent the device from autosuspending.

1947) Improper resource shutdown or release (CVE-ID: CVE-2026-89936)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leave the Vcc regulator enabled indefinitely.

The vulnerability exists due to improper resource shutdown or release in m62332_set_value() when writing successive non-zero values to a channel before writing zero. A local user can write successive non-zero values to a channel before writing zero to leave the Vcc regulator enabled indefinitely.

1948) Unchecked Return Value (CVE-ID: CVE-2026-89937)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of an error return in the SGP30 driver sgp_probe() and sgp_remove() functions when IAQ thread creation fails. A local user can cause IAQ thread creation to fail and subsequently trigger device removal to cause a denial of service.

1949) Use-after-free (CVE-ID: CVE-2026-89938)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to a use-after-free in the Atlas sensor driver's IRQ work handling when a pending irq_work executes after device removal. A local user can cause pending IRQ work to execute after device removal to compromise confidentiality, integrity, and availability.

Exploitation requires an enabled IIO buffer.

1950) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-89939)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to prevent the device from autosuspending.

The vulnerability exists due to a missing release of a runtime PM reference in atlas_buffer_postenable() when enabling an IIO buffer and interrupt configuration fails. A local user can enable an IIO buffer to prevent the device from autosuspending.

1951) Improper update of reference count (CVE-ID: CVE-2026-89944)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper reference count management in hdac_hda_dev_probe() when ASoC component registration fails during device probing. A local privileged user can cause component registration to fail to cause a denial of service.

1952) Race condition (CVE-ID: CVE-2026-89945)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause improper hardware register operations.

The vulnerability exists due to a race condition in the cs35l34 runtime suspend handler when runtime power management suspends the codec while critical fault IRQs remain unmasked. A local user can trigger runtime power management to cause improper hardware register operations.

1953) Race condition (CVE-ID: CVE-2026-89946)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect processing of amplifier fault release paths.

The vulnerability exists due to a race condition in the cs35l33 codec driver's runtime suspend and threaded IRQ handling when a threaded IRQ handler executes after runtime suspend has disabled live register access. A local user can cause a threaded IRQ handler to execute during runtime suspend to cause incorrect processing of amplifier fault release paths.

Critical fault IRQs must remain unmasked during runtime power management.

1954) Out-of-bounds read (CVE-ID: CVE-2026-89947)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information, modify data, and cause a denial of service.

The vulnerability exists due to an incorrect parent count in the gxbb_32k_clk_sel clock mux when registering the clock mux. A remote attacker can trigger registration of the affected clock mux to disclose sensitive information, modify data, and cause a denial of service.

1955) Incomplete cleanup (CVE-ID: CVE-2026-89948)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause bridge loop avoidance claims to remain after mesh interface deletion.

The vulnerability exists due to incomplete cleanup of claims in the batman-adv bridge loop avoidance claim cleanup logic when deleting a mesh interface. A local user can delete a mesh interface to cause bridge loop avoidance claims to remain after mesh interface deletion.

1956) Reliance on undefined behavior (CVE-ID: CVE-2026-89949)

CWE-ID: CWE-758 - Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of unaligned memory access in the batman-adv distributed ARP table IP extraction functions when processing ARP packets with unaligned data in socket buffers. A remote attacker can send an ARP packet to cause a denial of service.

Only hardware without native support for unaligned reads is affected.

1957) Reachable assertion (CVE-ID: CVE-2026-89950)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to missing skb linearization in batadv_mcast_forw_expand_head() when processing multicast packets via batadv_mcast_forw_mcsend(). A local user can trigger multicast packet forwarding to cause a denial of service.

1958) Use-after-free (CVE-ID: CVE-2026-89951)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to use-after-free in batadv_batman_skb_recv() when processing reassembled fragmented packets. A remote attacker can send fragmented packets to compromise confidentiality, integrity, and availability.

Exploitation requires a hard interface to be deleted before fragment reassembly completes.

1959) Out-of-bounds read (CVE-ID: CVE-2026-89952)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to read beyond allocated memory.

The vulnerability exists due to an out-of-bounds read in nand_flash_detect_ext_param_page() when parsing an ONFI extended parameter page with invalid section lengths. An attacker with physical access can supply a malformed ONFI extended parameter page to read beyond allocated memory.

1960) Memory leak (CVE-ID: CVE-2026-89953)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a memory leak in the mtdoops notification removal handler when a configured backing MTD device is removed and registered again while mtdoops remains loaded. A local privileged user can repeatedly remove and register the configured backing MTD device to exhaust vmalloc memory.

The issue is only exposed when the backing MTD device can disappear and later be registered again; typical static MTD configurations do not expose it.

1961) Out-of-bounds read (CVE-ID: CVE-2026-89954)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information, modify data, or cause a denial of service through an out-of-bounds memory access.

The vulnerability exists due to improper bounds checking in the AFS v2 parser when parsing a crafted AFS v2 image. A remote attacker can supply an image with a footer offset or region count that exceeds expected bounds to disclose sensitive information, modify data, or cause a denial of service through an out-of-bounds memory access.

1962) NULL pointer dereference (CVE-ID: CVE-2026-89955)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in status_show() when reading the sysfs status attribute during queue probing. A local user can concurrently read the status attribute before queue driver data is set to cause a denial of service.

1963) Improper locking (CVE-ID: CVE-2026-89956)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause kernel memory corruption or a use-after-free condition.

The vulnerability exists due to improper locking in the s390 VFIO AP mediated-device list handling when concurrently creating, removing, or looking up mediated devices. A local user can concurrently manipulate mediated devices to cause kernel memory corruption or a use-after-free condition.

1964) Incorrect Check of Function Return Value (CVE-ID: CVE-2026-89957)

CWE-ID: CWE-253 - Incorrect Check of Function Return Value

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to retain stale hardware access to AP devices removed from the host configuration.

The vulnerability exists due to incorrect handling of the bitmap_andnot() return value in vfio_ap_mdev_hot_unplug_cfg() when the last adapter, domain, or control domain assigned to an mdev is removed. A local user can remove the final assigned AP resource from the host configuration to retain stale hardware access to the unplugged AP devices.

1965) NULL pointer dereference (CVE-ID: CVE-2026-89958)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the s390/vfio-ap AP bus configuration callbacks when handling AP bus configuration changes while matrix_mdev->kvm is unset. A local user can trigger the AP bus configuration callbacks to cause a denial of service.

1966) Incorrect calculation (CVE-ID: CVE-2026-89959)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise the confidentiality, integrity, and availability of a KVM guest.

The vulnerability exists due to an incorrect bitmap operation in vfio_ap_mdev_cfg_remove when removing control domains from a mediated device. A local user can trigger control-domain removal to compromise the confidentiality, integrity, and availability of a KVM guest.

1967) Use-after-free (CVE-ID: CVE-2026-89960)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to a use-after-free in the s390 VFIO AP mediated-device KVM assignment handling when executing a PQAP instruction in a guest after a failed conflicting mediated-device assignment and subsequent freeing of the mediated device. A local user can trigger a conflicting mediated-device assignment and execute a PQAP instruction in the guest to compromise confidentiality, integrity, and availability.

1968) Incorrect calculation (CVE-ID: CVE-2026-89961)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to incorrect calculation of PFN offsets in vmemmap_populate_compound_pages() when populating compound-page vmemmap mappings. A local user can trigger compound-page vmemmap population to compromise confidentiality, integrity, and availability.

1969) Incorrect calculation (CVE-ID: CVE-2026-89962)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause data corruption or crashes.

The vulnerability exists due to incorrect range-merging logic in the powerpc kexec memory-range handling code when merging overlapping memory ranges for a kexec operation. A local privileged user can trigger a kexec operation with overlapping memory ranges to cause data corruption or crashes.

1970) Infinite loop (CVE-ID: CVE-2026-89964)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to failure to advance the parsing position in eisa_irq_setup() when processing an invalid eisa_irq_edge kernel command line parameter. A local privileged user can supply an invalid comma-separated IRQ value to cause a denial of service.

1971) Out-of-bounds write (CVE-ID: CVE-2026-89965)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in the nvdimm/btt arena I/O path when processing a crafted or foreign arena whose nfree value is below the lane count. A local user can provide a crafted or foreign arena to write past per-lane freelist and rtt array allocations and execute arbitrary code.

1972) Improper Enforcement of Behavioral Workflow (CVE-ID: CVE-2026-89968)

CWE-ID: CWE-841 - Improper Enforcement of Behavioral Workflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper validation of protocol state in nvmet_tcp_handle_h2c_data_pdu() when processing an unsolicited H2CData PDU before transmitting a requested data transfer (R2T). A remote attacker can send an H2CData PDU for a write command before the R2T is transmitted to cause a denial of service.

The affected subsystem must be configured with allow_any_host.

1973) Out-of-bounds write (CVE-ID: CVE-2026-89969)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in nvmet_tcp_try_recv_pdu() when receiving an over-long NVMe/TCP PDU. A remote attacker can send a duplicate ICReq PDU after header digest negotiation to execute arbitrary code.

The attacker-controlled overflow can overwrite the adjacent header and data digest fields before the duplicate ICReq is rejected.

1974) Use-after-free (CVE-ID: CVE-2026-89970)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to improper synchronization of delayed work in the NVMe target authentication submission queue teardown logic when an authentication timeout callback runs during submission queue teardown. A remote attacker can cause the authentication timeout work to race with submission queue teardown to compromise confidentiality, integrity, and availability.

1975) Use-after-free (CVE-ID: CVE-2026-89972)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to a missing SRCU grace period in the nvme_alloc_ns() error path when concurrently accessing NVMe multipath namespace paths. A remote attacker can trigger concurrent namespace access during error handling to compromise confidentiality, integrity, and availability.

1976) Improper input validation (CVE-ID: CVE-2026-89973)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in nvme_tcp_handle_c2h_data() when processing a C2HData PDU for a write command. A remote attacker can send a C2HData PDU in response to a write command to cause a denial of service.

On hosts booted with panic_on_warn, the triggered kernel warning is fatal.

1977) Memory leak (CVE-ID: CVE-2026-89975)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory release in nvmf_parse_options() when parsing malformed DH-CHAP secret options written to /dev/nvme-fabrics. A local user can repeatedly submit malformed dhchap_secret or dhchap_ctrl_secret values to cause a denial of service.

Only systems with CONFIG_NVME_HOST_AUTH enabled are affected. No NVMe-oF target or working transport connection is required.

1978) Race condition (CVE-ID: CVE-2026-89979)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause inconsistent PCM state transitions.

The vulnerability exists due to a race condition in ALSA PCM trigger-start handling when concurrently performing non-atomic PCM operations. A local user can concurrently issue a PCM start trigger and non-atomic PCM operations to cause inconsistent PCM state transitions.

1979) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-89982)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to missing release of a Device Tree channel node reference in i2c_mux_add_adapter() when adapter registration fails. A local user can trigger an adapter registration failure to cause a memory leak.

1980) Use-after-free (CVE-ID: CVE-2026-89983)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the I2C core adapter debugfs directory handling when a write to the new_device sysfs attribute races with adapter removal. A local user can write to the new_device sysfs attribute during adapter removal to cause a denial of service.

1981) Improper access control (CVE-ID: CVE-2026-89984)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose kernel addresses.

The vulnerability exists due to improper privilege-level validation in the intel_pmu_lbr_filter() LBR stack filtering function when filtering sampled LBR entries for user-only branch stacks. A local user can request a user-only branch stack through perf to disclose kernel addresses.

The issue affects systems where architectural LBR lacks CPL filtering support.

1982) Use-after-free (CVE-ID: CVE-2026-89988)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code, escalate privileges, disclose sensitive information, or cause a denial of service.

The vulnerability exists due to a use-after-free in the kprobe blacklist traversal function __within_kprobe_blacklist() when concurrently checking a kprobe blacklist entry during module unloading. A local user can trigger concurrent blacklist traversal and entry removal to dereference freed memory.

The blacklist traversal can occur in atomic or non-preemptible contexts.

1983) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-89989)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of error return values in validate_hash_algo() in IMA appraisal when processing a dentry path that exceeds the buffer. A local user can trigger an extended attribute operation that causes dentry_path() to return an error pointer to cause a denial of service.

1984) Release of invalid pointer or reference (CVE-ID: CVE-2026-89992)

CWE-ID: CWE-763 - Release of invalid pointer or reference

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to an invalid pointer release in the dt_idle_genpd cpuidle power-domain code when freeing an idle power-domain name. A remote attacker can trigger the release of a pointer to the basename rather than the original allocation to compromise confidentiality, integrity, and availability.

1985) NULL pointer dereference (CVE-ID: CVE-2026-89993)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a null pointer dereference.

The vulnerability exists due to improper initialization of IRQ data in dw_edma_irq_request() when a shared interrupt is handled before dw_edma_channel_setup() initializes the back pointer. A local user can trigger a shared interrupt during initialization to trigger a null pointer dereference.

1986) Type Confusion (CVE-ID: CVE-2026-89995)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to type confusion in dma_direct_alloc_from_pool() when dma_direct_alloc_pages() uses DMA coherent pool allocations. A remote attacker can trigger DMA page allocation through the affected path to compromise confidentiality, integrity, and availability.

1987) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-89996)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak dma-buf file descriptors.

The vulnerability exists due to improper resource management in DMA_HEAP_IOCTL_ALLOC handling when copying allocation results to userspace fails. A local user can trigger a copy_to_user failure to leak dma-buf file descriptors.

1988) Race condition (CVE-ID: CVE-2026-89997)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to a race condition in the device-mapper resume and remove handling when issuing resume and remove ioctls concurrently. A local user can issue resume and remove ioctls concurrently to cause a use-after-free condition.

In the dm-integrity target, the reboot notifier can remain registered after device removal.

1989) Race condition (CVE-ID: CVE-2026-89998)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access invalid memory.

The vulnerability exists due to a race condition in the device-mapper table device list handling when processing concurrent table load ioctls. A local user can issue concurrent table load ioctls, causing one operation to succeed while another fails, to access invalid memory.

1990) Out-of-bounds read (CVE-ID: CVE-2026-89999)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.2 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information and cause a denial of service.

The vulnerability exists due to an out-of-bounds read in wacom_intuos_pro2_bt_irq in the HID Wacom driver when processing undersized Bluetooth reports. A remote attacker can send a crafted undersized Bluetooth report to disclose sensitive information and cause a denial of service.

The peripheral must be paired or spoofed and advertise a matching VID/PID.

1991) Out-of-bounds write (CVE-ID: CVE-2026-90000)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information, corrupt memory, or cause a denial of service.

The vulnerability exists due to out-of-bounds read and write operations in the hid-rmi driver when handling undersized RMI reports. A remote attacker can send specially crafted RMI reports to disclose sensitive information, corrupt memory, or cause a denial of service.

A zero-length reply can cause the read loop to run indefinitely with page_mutex held.

1992) Use-after-free (CVE-ID: CVE-2026-90002)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ftrace set_ftrace_filter and set_ftrace_notrace trace instance files when opening a filter file concurrently with trace instance removal. A local user can race opening a filter file with removal of the trace instance to cause a denial of service.

1993) Use-after-free (CVE-ID: CVE-2026-90003)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code, disclose sensitive information, or cause a denial of service.

The vulnerability exists due to a use-after-free in the futex requeue priority-inheritance handling when racing an early waiter wakeup with a priority-inheritance futex requeue. A local user can trigger FUTEX_CMP_REQUEUE_PI operations to access a waiter's stack-allocated futex queue after the waiter returns from the system call.

Exploitation is limited to systems using PREEMPT_RT.

1994) Improper resource shutdown or release (CVE-ID: CVE-2026-90007)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leave previously registered interrupt handlers installed.

The vulnerability exists due to incorrect rollback index handling in the pm8001_request_msix() function when handling a request_irq() failure during MSI-X vector registration. A local user can trigger the faulty rollback loop to leave previously registered interrupt handlers installed.

1995) Out-of-bounds read (CVE-ID: CVE-2026-90011)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information and cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the iSCSI target login payload buffer when processing a crafted login PDU without a terminating null byte. A remote attacker can send a crafted login PDU to disclose sensitive information and cause a denial of service.

Exploitation is reachable through the CHAP authentication path on a portal configured for CHAP.

1996) Use-after-free (CVE-ID: CVE-2026-90013)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free kernel crash.

The vulnerability exists due to a use-after-free in tracefs options files when an options file is opened while another task removes its associated tracing instance. A local user can open an options file for a tracing instance and trigger removal of that instance to cause a use-after-free kernel crash.

1997) Improper resource shutdown or release (CVE-ID: CVE-2026-90015)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause data corruption and leak DMA mappings.

The vulnerability exists due to improper handling of bounce buffers in the xHCI transfer descriptor bounce-buffer cleanup logic when processing sufficiently large fragmented bulk USB transfers that span multiple ring segments. A local user can submit a crafted bulk transfer to cause data corruption and leak DMA mappings.

For IN transfers, unreturned bounce-buffer data can leave a wMaxPacketSize-sized region of the destination buffer containing its previous contents.

1998) Out-of-bounds read (CVE-ID: CVE-2026-90016)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information and cause a denial of service.

The vulnerability exists due to an out-of-bounds read in rtw_restruct_wmm_ie() in the rtl8723bs driver when processing attacker-influenced information element buffers from association or scan data. A remote attacker can provide crafted association or scan data to disclose sensitive information and cause a denial of service.

1999) Out-of-bounds read (CVE-ID: CVE-2026-90017)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in rtw_action_frame_parse() in the rtl8723bs driver when processing a short management action frame. A remote attacker can send a crafted management action frame to cause a denial of service.

The frame can be as short as the 24-byte IEEE 802.11 three-address header.

2000) Stack-based buffer overflow (CVE-ID: CVE-2026-90018)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to a stack-based buffer overflow in rtw_get_wps_attr() when processing a crafted WPS information element in a wireless management frame. A remote attacker can send a crafted beacon or probe response during scanning to compromise confidentiality, integrity, and availability.

2001) NULL pointer dereference (CVE-ID: CVE-2026-90019)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in usb_put_function_instance() when handling an error during UVC function instance allocation. A remote attacker can trigger the error path to cause a denial of service.

The issue occurs before the fd member of the function instance is allocated.

2002) Race condition (CVE-ID: CVE-2026-90020)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in gadget_dev_ioctl() when handling ioctl requests concurrently with device binding. A local user can issue ioctl requests during a concurrent bind operation to cause a denial of service.

2003) Improper initialization (CVE-ID: CVE-2026-90021)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a kernel warning.

The vulnerability exists due to improper initialization of a work structure in f_midi_alloc() when freeing a MIDI gadget function that was not bound. A local user can free an unbound MIDI gadget function to cause a kernel warning.

The warning occurs in __flush_work because the work function pointer is null.

2004) Use-after-free (CVE-ID: CVE-2026-90022)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code, disclose sensitive information, or cause a denial of service.

The vulnerability exists due to use-after-free in the f_midi2 string attribute show path when concurrently reading and writing string attributes. A local user can concurrently access and modify string attributes to execute arbitrary code, disclose sensitive information, or cause a denial of service.

2005) NULL pointer dereference (CVE-ID: CVE-2026-90023)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in fsg_common_set_num_buffers() when processing a number-of-buffers value of 0. A local user can set the number-of-buffers value to 0 to cause a denial of service.

2006) NULL pointer dereference (CVE-ID: CVE-2026-90024)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null-pointer dereference in f_midi2_free_ep_reqs() when configuring the MIDI 2.0 gadget through configfs with the block direction set to SNDRV_UMP_DIR_INPUT. A local user can configure the gadget with this block direction to cause a denial of service.

A host must set the alternate setting after the gadget is configured.

2007) Out-of-bounds read (CVE-ID: CVE-2026-90025)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the UCSI DisplayPort driver's port altmode array when processing an invalid GET_CURRENT_CAM response from the PPM. A remote attacker can cause the PPM to return an altmode array index above UCSI_MAX_ALTMODES to cause a denial of service.

2008) Use-after-free (CVE-ID: CVE-2026-90026)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to a use-after-free in the Qualcomm PMIC Type-C PD PHY driver's reset_work handling when pending reset_work executes after device removal frees its associated structure. A local user can trigger the race condition to compromise confidentiality, integrity, and availability.

The race requires the IRQ handler to schedule reset_work immediately before IRQs are disabled.

2009) Use-after-free (CVE-ID: CVE-2026-90029)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to trigger a use-after-free.

The vulnerability exists due to a use-after-free in the Realtek USB card reader driver's suspend timer handling when disconnecting a USB device while the timer callback is running. An attacker with physical access can disconnect the device while the callback rearms the timer to trigger a use-after-free.

The issue applies to configurations with Realtek automatic power management enabled.

2010) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-90030)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource lifetime management in DWC3 EndTransfer handling when aborting a transfer through the ep_dequeue path and subsequently starting a transfer on the same endpoint. A local user can trigger this transfer sequence to cause a denial of service.

The observed condition affects DWC_usb31 v2.00a and v2.10a controllers.

2011) Race condition (CVE-ID: CVE-2026-90031)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to trigger a warning that a URB is already active.

The vulnerability exists due to a race condition in the ENE UB6250 USB-storage driver when delayed scan work runs concurrently with card-type probing. An attacker with physical access can cause concurrent access to us->current_urb during device probing to trigger a warning that a URB is already active.

2012) Use-after-free (CVE-ID: CVE-2026-90032)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to use-after-free in snd_usbtv_pcm_close() in the usbtv audio driver when closing an ALSA PCM file after USB disconnect. A local user can close a previously opened ALSA PCM file after USB disconnect to compromise confidentiality, integrity, and availability.

2013) Out-of-bounds write (CVE-ID: CVE-2026-90033)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in snd_usbmidi_us122l_output() when processing MIDI output for a USB device that declares a bulk endpoint smaller than the expected transfer count. An attacker with physical access can connect a crafted USB device to cause a denial of service.

2014) Use of uninitialized resource (CVE-ID: CVE-2026-90034)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to use of uninitialized memory in the mdc800 USB driver buffer initialization when receiving shorter messages. An attacker with physical access can send a shorter message to disclose sensitive information.

2015) Division by zero (CVE-ID: CVE-2026-90035)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to division by zero in get_estimated_bw() when processing an estimated-bandwidth-change notification from a connected USB4/DPIA tunneling device before a bandwidth-allocation capability-change notification. An attacker with physical access can connect a device that reports an estimated-bandwidth change to cause a denial of service.

2016) Use-after-free (CVE-ID: CVE-2026-90036)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in the NFSD blocked-lock reaping logic when reaping blocked locks concurrently with client expiration. A remote attacker can cause a client to be freed before nfs4_put_stateowner() dereferences its cl_lock to trigger a use-after-free condition.

2017) Use-after-free (CVE-ID: CVE-2026-90037)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to use-after-free in NFSD NFSv4 state management when reaping timed-out close_lru entries concurrently with client expiration. A remote attacker can trigger the use-after-free condition to compromise confidentiality, integrity, and availability.

2018) Use-after-free (CVE-ID: CVE-2026-90041)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a use-after-free in the Sony HID driver's device list handling when handling probe failures for matching controllers. A remote attacker can cause a controller to remain linked in the device list after its driver state is freed to execute arbitrary code.

2019) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-90042)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of non-linear memory buffers in ceph_fname_to_usr() when processing MDS messages held in vmalloc()-allocated buffers. A remote attacker can cause a message containing encrypted filenames to be processed to cause a denial of service.

The issue can result in kernel oopses, especially on non-x86 platforms.

2020) Use-after-free (CVE-ID: CVE-2026-90044)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to use-after-free in ffs_epfile_write_iter() and ffs_epfile_read_iter() when a concurrent cancellation operation runs after an asynchronous I/O operation fails. A local user can submit an asynchronous I/O operation and cancel it concurrently to compromise confidentiality, integrity, and availability.

2021) Use-after-free (CVE-ID: CVE-2026-90045)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to a use-after-free in the FunctionFS asynchronous I/O handling in drivers/usb/gadget/function/f_fs.c when asynchronous read requests remain pending after the submitting task exits. A local user can queue an asynchronous read request and exit before completion handling finishes to compromise confidentiality, integrity, and availability.

2022) Out-of-bounds write (CVE-ID: CVE-2026-90048)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to an out-of-bounds write in ni_create_attr_list() in the NTFS3 filesystem driver when processing a crafted loop-mounted NTFS image. A remote attacker can craft an NTFS image containing many nameless minimum-size resident attributes to compromise confidentiality, integrity, and availability.

Exploitation is reached by opening a file on the mounted image and adding an attribute.

2023) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-90049)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause data corruption.

The vulnerability exists due to improper resource lifetime management in skb_zerocopy() when processing a packet through Open vSwitch's OVS_ACTION_ATTR_USERSPACE path after skb_orphan_frags() fails. A remote attacker can trigger the error path to cause data corruption.

2024) Infinite loop (CVE-ID: CVE-2026-90053)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an infinite loop in the HTB packet classifier htb_classify() when processing packets with cyclic inner-class filter selections. A local user can configure cyclic HTB filters and send a packet to cause a denial of service.

Exploitation is reachable through an unprivileged user namespace that provides CAP_NET_ADMIN.

2025) Incorrect calculation (CVE-ID: CVE-2026-90054)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt TCP stream data.

The vulnerability exists due to incorrect calculation of the retransmission length in the TCP retransmission path when retransmitting TCP urgent data across multiple segments. A remote attacker can send TCP urgent data that is retransmitted across multiple segments to corrupt TCP stream data.

2026) Reliance on undefined behavior (CVE-ID: CVE-2026-90055)

CWE-ID: CWE-758 - Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger undefined behavior.

The vulnerability exists due to improper initialization of ci_range bit counts in usbatm_atm_init() when processing ATM PVC bind requests. A remote attacker can bind an ATM PVC to trigger undefined behavior.

2027) Use of uninitialized resource (CVE-ID: CVE-2026-90056)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use of an uninitialized resource in the FEC Ethernet driver PTP cleanup paths when handling failed device initialization or device removal. A local user can trigger failed device initialization or device removal to cause a denial of service.

PTP initialization is performed only when extended buffer descriptors are available.

2028) Use-after-free (CVE-ID: CVE-2026-90057)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free read.

The vulnerability exists due to use-after-free in slip_receive_buf() when racing SLIP receive processing against TTY hangup. A local user can trigger concurrent receive processing and TTY hangup to trigger a use-after-free read.

2029) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-90058)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper validation of user-supplied size table values in __qdisc_calculate_pkt_len() when processing a crafted TCA_STAB configuration that amplifies packet length values. A local user can configure a DRR or ETS qdisc with a crafted size table, set a tiny quantum, and send a small packet to cause a denial of service.

The issue requires NET_SCHED and either the DRR or ETS scheduler to be enabled.

2030) NULL pointer dereference (CVE-ID: CVE-2026-90060)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the ALSA kcontrol LED state layer when tracking a write-only kcontrol without a get callback. A local user can create a write-only control element without a get callback to cause a denial of service.

2031) Incorrect behavior order (CVE-ID: CVE-2026-90062)

CWE-ID: CWE-696 - Incorrect Behavior Order

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an inconsistent state between hardware-offloaded and software rulesets.

The vulnerability exists due to incorrect behavior order in nf_tables commit processing when committing rulesets with hardware flow-rule offload. A local user can commit a ruleset with hardware flow-rule offload to cause an inconsistent state between hardware-offloaded and software rulesets.

The inconsistency can occur if chain blob preparation fails after the hardware ruleset has been offloaded.

2032) Integer overflow (CVE-ID: CVE-2026-90063)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a 16-bit gso_segs field overflow.

The vulnerability exists due to improper validation of gso_size in virtio_net_hdr_to_skb when processing TCP packets crafted through an AF_PACKET PACKET_VNET_HDR socket. A local user can submit a TCP packet with a gso_size smaller than TCP_MIN_GSO_SIZE to cause a 16-bit gso_segs field overflow.

The condition applies to TCP packets; UDP GSO permits a gso_size of 1.

2033) NULL pointer dereference (CVE-ID: CVE-2026-90066)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper validation of an error pointer in ftrace_direct_multi_init() and ftrace_direct_multi_exit() in samples/ftrace/ftrace-direct-multi-modify.c when unloading the ftrace-direct-multi-modify module after kthread_run() fails. A local privileged user can cause kthread_stop() to receive an error pointer to cause a denial of service.

2034) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-90067)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a kernel warning.

The vulnerability exists due to improper validation of banner payload length in the Ceph messenger v2 banner parser when parsing a crafted protocol banner. A remote attacker can send a banner with a zero-length payload to trigger a kernel warning.

The protocol requires banner payloads to contain at least two 64-bit feature fields.

2035) Off-by-one (CVE-ID: CVE-2026-90068)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read memory out of bounds.

The vulnerability exists due to an off-by-one error in snd_soc_dapm_put_enum_double() when writing a second enum channel value. A local user can set the second enum channel value equal to the number of enum items to read one element past the end of the value table.

The affected adav80x control reports two values, and core input validation is disabled by default.

2036) Unchecked Return Value (CVE-ID: CVE-2026-90070)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause TPM status checks to complete spuriously.

The vulnerability exists due to an unchecked return value in the st33zp24_status callback when processing failed TPM transport reads. A local user can trigger a TPM status read to cause TPM status checks to complete spuriously.

On I2C transports, this can occur when the register-select write is short or fails.

2037) Use-after-free (CVE-ID: CVE-2026-90071)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to failure to restore the skb->dev device pointer in the sch_teql TEQL scheduler when transmitting packets through TEQL slave devices. A local user can cause a packet to retain a stale device pointer after a slave transmission failure.

Exploitation requires a later slave device without a resolved neighbour and deletion of the previous slave while the packet remains queued.

2038) Integer overflow (CVE-ID: CVE-2026-90072)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in sfq_init() of the SFQ queueing discipline when initializing SFQ on a device with an MTU that wraps psched_mtu() into the sign bit. A local user can configure a device with a crafted MTU value to cause a denial of service.

Exploitation requires CAP_NET_ADMIN in a user namespace.

2039) Integer overflow (CVE-ID: CVE-2026-90073)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in the HHF queuing discipline's hhf_dequeue() function when configuring an HHF qdisc on a device with an oversized MTU. A local user can configure the HHF qdisc to trigger an infinite loop to cause a denial of service.

Exploitation requires CAP_NET_ADMIN in a user namespace and a device whose MTU plus hard-header length wraps psched_mtu() into the sign bit.

2040) Integer overflow (CVE-ID: CVE-2026-90074)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to signed integer overflow in the fq_pie queuing discipline when initializing the default quantum from a device MTU. A local privileged user can configure a device with a huge MTU to cause a denial of service.

Exploitation requires CAP_NET_ADMIN in a user namespace and a device whose MTU plus hard header length causes psched_mtu() to wrap into the sign bit.

2041) Integer overflow (CVE-ID: CVE-2026-90075)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an integer overflow in the fq_codel queueing discipline initialization when initializing fq_codel on a device whose MTU causes psched_mtu() to wrap into the sign bit. A local privileged user can configure a device with an oversized MTU to cause a denial of service.

2042) Integer overflow (CVE-ID: CVE-2026-90076)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in the fq qdisc initialization function fq_init() when initializing an fq qdisc for a device with a huge MTU. A local user can configure a device with an excessively large MTU to cause a denial of service.

Exploitation requires CAP_NET_ADMIN in a user namespace and an MTU plus hard_header_len large enough to make 2 * psched_mtu() wrap.

2043) Integer underflow (CVE-ID: CVE-2026-90078)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper length calculation in tcf_skbmod_act() when processing short IP packets at TC ingress. A remote attacker can send a short IP packet to cause a denial of service.

Exploitation requires the skbmod action to process ECN modifications at TC ingress.

2044) Race condition (CVE-ID: CVE-2026-90081)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in rds_cong_map_updated() when handling congestion map updates. A local user can race congestion map updates with waiter registration to cause a denial of service.

A sender waiting on a congested port can remain blocked until another congestion update arrives or a signal is delivered, and poll() waiters can miss map-update notifications.

2045) Improper input validation (CVE-ID: CVE-2026-90088)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in rfcomm_apply_pn() when processing remote parameter negotiation frames. A remote attacker can send a parameter negotiation frame with an MTU value of zero to cause a denial of service.

2046) Out-of-bounds read (CVE-ID: CVE-2026-90090)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the Linux kernel btmtksdio_tx_packet() transmit path when transmitting Bluetooth packets over SDIO. A local user can send a packet that causes memory beyond the packet data to be read and sent to the device to disclose sensitive information.

2047) Use-after-free (CVE-ID: CVE-2026-90092)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a use-after-free condition.

The vulnerability exists due to a race condition in l2cap_sock_new_connection_cb when handling new L2CAP connections during parent L2CAP channel teardown. A remote attacker can initiate a new L2CAP connection while a parent socket is being torn down to trigger a use-after-free condition.

2048) Function Call with Incorrectly Specified Arguments (CVE-ID: CVE-2026-90101)

CWE-ID: CWE-628 - Function Call with Incorrectly Specified Arguments

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an incorrectly specified function argument in the bnxt hardware monitoring event handler when handling hardware monitoring events. A local user can trigger the affected event handler to cause a denial of service.

2049) NULL pointer dereference (CVE-ID: CVE-2026-90102)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper cache keying in the NFSv4 pNFS data server cache when processing GETDEVICEINFO data. A remote attacker can supply device information for two device IDs using the same data server address with different major NFS versions to cause a denial of service.

2050) Incorrect Calculation of Buffer Size (CVE-ID: CVE-2026-90103)

CWE-ID: CWE-131 - Incorrect Calculation of Buffer Size

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to incorrect buffer size calculation in the NFSv4.2 flexfiles layoutstats encoder when encoding layout statistics for a flexfiles layout. A remote attacker can provide crafted server-controlled filehandle and network-address data to exhaust the send buffer and leave a lock permanently held to cause a denial of service.

2051) Memory leak (CVE-ID: CVE-2026-90107)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in smc_llc_flow_stop() when a late duplicate CONFIRM_LINK or ADD_LINK_CONT message arrives before the flow completes. A remote attacker can send a duplicate message during this window to cause a denial of service.

2052) Memory leak (CVE-ID: CVE-2026-90108)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a memory leak.

The vulnerability exists due to improper memory management in smc_llc_event_handler() when handling an ADD_LINK request after a CONFIRM_LINK or ADD_LINK_CONT message has been stashed during the SMC_LLC_FLOW_REQ_ADD_LINK state. A remote attacker can send a sequence of LLC messages to cause a memory leak.

The overwritten stashed entry is a kmalloc allocation with no consumer in this flow state.

2053) Integer overflow (CVE-ID: CVE-2026-90109)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a 32-bit integer overflow in the gred_enqueue(), bfifo_enqueue(), and plug_enqueue() queue admission functions when calculating queue admission with a backlog exceeding 4 GiB. A local privileged user can attach a qdisc with a queue limit near 4 GiB and enqueue more than 4 GiB of traffic to cause a denial of service.

2054) Use of insufficiently random values (CVE-ID: CVE-2026-90110)

CWE-ID: CWE-330 - Use of Insufficiently Random Values

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass IP-keyed ICMP rate limits and infer open UDP ports.

The vulnerability exists due to predictable tree ordering in the inetpeer rate limiting system when processing packets from remote IP addresses. A remote attacker can trigger garbage collection and selectively evict inet_peer entries to bypass IP-keyed ICMP rate limits and infer open UDP ports.

Re-created entries have their rate-limiting token buckets reset to full capacity.

2055) Out-of-bounds read (CVE-ID: CVE-2026-90112)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read.

The vulnerability exists due to improper bounds checking in the qlcnic firmware ROM parser and loader when processing a malformed firmware image. A local user can provide a truncated or malformed firmware image to cause an out-of-bounds read.

2056) Signed to Unsigned Conversion Error (CVE-ID: CVE-2026-90114)

CWE-ID: CWE-195 - Signed to Unsigned Conversion Error

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause unpredictable request return values.

The vulnerability exists due to an incorrect signed-to-unsigned conversion in br_process_vlan_tunnel_info when processing bridge VLAN tunnel range requests. A local user can submit a bridge VLAN tunnel range with descending VLAN IDs to cause unpredictable request return values.

2057) NULL pointer dereference (CVE-ID: CVE-2026-90115)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the __xsk_rcv() multi-buffer receive path when allocating buffers for a packet. A local user can supply fill queue entries that are rejected during buffer allocation to cause a denial of service.

2058) Memory leak (CVE-ID: CVE-2026-90119)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause resource leaks.

The vulnerability exists due to missing cleanup in snd_ice1712_probe() when a later initialization step fails. A local privileged user can trigger a probe failure to cause resource leaks.

2059) Use of Uninitialized Variable (CVE-ID: CVE-2026-90122)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use of an uninitialized variable in visconti_clk_register_gate() when registering a clock gate. A local user can trigger clock gate registration to cause a denial of service.

The issue is exposed when CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE is enabled.

2060) Race condition (CVE-ID: CVE-2026-90124)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause interrupts to be lost.

The vulnerability exists due to a race condition in the Renesas RZ/G2L interrupt controller driver's rzg2l_clear_irq_int() and rzg2l_clear_tint_int() functions when clearing interrupt status bits. A local user can trigger multiple interrupts simultaneously to cause interrupts to be lost.

2061) Memory leak (CVE-ID: CVE-2026-90125)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource release in smb2_new_read_req() in the SMB client when handling asynchronous SMB2 read requests after memory registration fails. A local user can issue asynchronous SMB2 read requests during a memory registration failure to cause a denial of service.

Only asynchronous SMB read operations are affected. On hard mounts, replayable failures can repeat the operation without a retransmission-count bound.

2062) Memory leak (CVE-ID: CVE-2026-90126)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper resource cleanup in the pcf8563 RTC driver's CLKOUT clock provider registration when repeatedly binding and unbinding a device. A local privileged user can repeatedly bind and unbind a device or reload the module to cause a denial of service.

2063) Memory leak (CVE-ID: CVE-2026-90128)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through memory resource exhaustion.

The vulnerability exists due to improper resource cleanup in add_direct_chain() in the vdpa/mlx5 memory-region handling code when handling allocation errors while creating a direct memory-region chain. A local user can trigger an allocation error to cause a denial of service through memory resource exhaustion.

Newly allocated direct memory-region entries are kept on a temporary list until the operation succeeds.

2064) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-90130)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of an initialization failure in the vDPA simulator cleanup path when creating a vDPA simulator and worker creation fails. A local user can trigger vDPA simulator initialization under this failure condition to cause a denial of service.

2065) Use-after-free (CVE-ID: CVE-2026-90135)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the alloc_netdev_mqs() reference tracker cleanup when reading ref_tracker debugfs entries after alloc_percpu() or dev_addr_init() fails. A local user can read a ref_tracker debugfs entry to cause a denial of service.

2066) Out-of-bounds read (CVE-ID: CVE-2026-90137)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read beyond the bounds of an ACPI package array.

The vulnerability exists due to an out-of-bounds read in the hp-bioscfg password PSWD_ENCODINGS parser when processing a malformed ACPI password encodings package. A local user can trigger parsing of a malformed package to read beyond the bounds of an ACPI package array.

2067) Memory leak (CVE-ID: CVE-2026-90138)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a resource leak.

The vulnerability exists due to improper socket error handling in vsock_accept() when accepting a connection after a failed connection attempt on the listener. A remote attacker can perform a failed self-connect and then accept a valid incoming vsock connection to cause a resource leak.

The leak affects virtio and hyperv transports because rejected child sockets are not freed.

2068) NULL pointer dereference (CVE-ID: CVE-2026-90139)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in fuse_fill_super_submount when processing an auto-submount after root inode allocation fails under memory pressure. A local user can access an auto-submount to cause a denial of service.

2069) Use-after-free (CVE-ID: CVE-2026-90140)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a use-after-free in the cuse module's pending RCU callback handling when unloading the cuse module while a fuse connection release callback remains pending. A local privileged user can close /dev/cuse and unload the cuse module before the callback executes to cause a denial of service.

2070) Integer overflow (CVE-ID: CVE-2026-90141)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause the FTP helper to configure a data connection with a truncated port or address.

The vulnerability exists due to integer overflow in the ip_vs_ftp_get_addrport() function of the IPVS FTP helper when parsing a crafted FTP PASV or EPSV response. A remote attacker can send a crafted FTP PASV or EPSV response to cause the FTP helper to configure a data connection with a truncated port or address.

2071) Improper locking (CVE-ID: CVE-2026-90143)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a kernel warning.

The vulnerability exists due to improper locking in kcm_parse_func_strparser() when executing a KCM strparser BPF program. A local user can invoke BPF map operations from the program to cause a kernel warning.

2072) Improper input validation (CVE-ID: CVE-2026-90146)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass XDP program attachment restrictions.

The vulnerability exists due to improper input validation in XDP link update handling when replacing an XDP program through BPF_LINK_UPDATE. A local user can create an XDP link with a normal program and replace it with an offloaded or device-bound program to bypass XDP program attachment restrictions.

2073) NULL pointer dereference (CVE-ID: CVE-2026-90148)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in nfs4_add_lease() when a lease request races with a delegation return. A local user can trigger the race condition to cause a denial of service.

2074) Memory leak (CVE-ID: CVE-2026-90150)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause device resource leaks.

The vulnerability exists due to improper resource cleanup in the pNFS block layout device parsing and cleanup routines when handling child-device parsing failures. A remote attacker can trigger a child-device parsing failure to cause device resource leaks.

2075) Use-after-free (CVE-ID: CVE-2026-90151)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a use-after-free.

The vulnerability exists due to a use-after-free in the NFSv4 callback identifier IDR when an NFSv4.0 callback lookup occurs after a client allocation failure. A remote attacker can trigger an NFSv4.0 callback lookup using the stale callback identifier to trigger a use-after-free.

Exploitation requires an NFSv4.0 client allocation to fail after a callback identifier has been allocated.

2076) Memory leak (CVE-ID: CVE-2026-90152)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in ksmbd_session_register() when registering an SMB session and xa_store() fails. A remote attacker can initiate SMB session setup requests that result in failed session registration to cause a denial of service.

2077) Incorrect authorization (CVE-ID: CVE-2026-90153)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain unauthorized access.

The vulnerability exists due to improper authorization in smb_check_perm_dacl() in the ksmbd SMB server when processing a crafted DACL during SMB2_CREATE access validation. A remote attacker can submit a crafted DACL containing an access-granting ACE beyond its declared boundary to gain unauthorized access.

2078) Signed to Unsigned Conversion Error (CVE-ID: CVE-2026-90157)

CWE-ID: CWE-195 - Signed to Unsigned Conversion Error

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a hardened usercopy warning.

The vulnerability exists due to an improper signed-to-unsigned conversion in __cgroup_bpf_run_filter_getsockopt_kern() when a cgroup getsockopt BPF program modifies ctx.optlen after the kernel getsockopt handler has run. A local user can set ctx.optlen to a negative value to trigger a hardened usercopy warning.

The issue affects the kernel-buffer getsockopt path used by TCP_ZEROCOPY_RECEIVE.

2079) Deadlock (CVE-ID: CVE-2026-90158)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in nfcon_device() when determining active consoles. A local user can trigger the console device callback to cause a denial of service.

2080) Improper locking (CVE-ID: CVE-2026-90159)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger a kernel warning.

The vulnerability exists due to improper locking in bpf_setsockopt() and bpf_getsockopt() when invoking the helpers from cgroup UNIX getname hooks. A local privileged user can call bpf_setsockopt() or bpf_getsockopt() from a BPF program attached to a BPF_CGROUP_UNIX_GETPEERNAME or BPF_CGROUP_UNIX_GETSOCKNAME hook to trigger a kernel warning.

2081) Off-by-one (CVE-ID: CVE-2026-90160)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an off-by-one headroom validation error in the lwt_bpf bpf_xmit() path when an LWT_XMIT BPF program modifies skb headroom. A local privileged user can call bpf_skb_change_head() to leave insufficient headroom and cause a denial of service.

On Ethernet, cached hardware-header output requires 16 bytes of headroom although the device hard-header length is 14 bytes.

2082) NULL pointer dereference (CVE-ID: CVE-2026-90166)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in ksmbd_ipc_tree_connect_request() when processing an IPC tree connect request. A remote attacker can send an IPC tree connect request to cause a denial of service.

2083) Memory leak (CVE-ID: CVE-2026-90169)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in ksmbd preauthentication session handling when a client disconnects after sending a binding NTLM negotiate request and before sending an authenticate request. A remote attacker can initiate an SMB3.1.1 multichannel binding negotiation and disconnect before authentication completes to cause a denial of service.

2084) Out-of-bounds read (CVE-ID: CVE-2026-90170)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read memory out of bounds.

The vulnerability exists due to an out-of-bounds read in the ksmbd ipc_validate_msg() function when processing undersized IPC responses supplied by the userspace ksmbd daemon. A local user can provide a short IPC response to read memory out of bounds.

The issue is reachable for KSMBD_EVENT_RPC_REQUEST messages.

2085) Memory leak (CVE-ID: CVE-2026-90175)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory release in the KSMBD authentication and user-configuration handlers when processing KSMBD login requests. A local user can trigger KSMBD login processing to cause a denial of service.

2086) Improper locking (CVE-ID: CVE-2026-90176)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass byte-range lock restrictions.

The vulnerability exists due to improper lock checking in the ksmbd check_lock_range() function when handling one-byte read, write, copychunk, or truncate operations. A remote attacker can issue a one-byte operation that conflicts with an existing byte-range lock to bypass byte-range lock restrictions.

2087) Memory leak (CVE-ID: CVE-2026-90178)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a memory leak.

The vulnerability exists due to improper resource release in the coretemp driver when removing a coretemp device on CPUs without package thermal support. A local privileged user can trigger coretemp device removal to cause a memory leak.

2088) Use-after-free (CVE-ID: CVE-2026-90180)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in the mtip32xx ioctl handlers when an ioctl races with device removal. A local user can issue an ioctl against an already open block device during device removal to trigger a use-after-free condition.

The issue affects both native and compatibility ioctl handlers.

2089) Race condition (CVE-ID: CVE-2026-90184)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a race condition in the null_blk configfs attribute store methods when concurrently updating device configuration attributes during device setup. A local privileged user can modify a device configuration attribute during device setup to cause a denial of service.

2090) Race condition (CVE-ID: CVE-2026-90185)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a race condition in the null_blk configfs attribute store handlers when concurrently storing configuration attributes through separate configfs file descriptors. A local privileged user can perform concurrent configuration attribute stores to cause a denial of service.

2091) NULL pointer dereference (CVE-ID: CVE-2026-90186)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in null_blk shared tag set queue-resize handling when resizing submit_queues or poll_queues through configfs on a device with shared_tags enabled. A local privileged user can resize the per-device queue configuration to cause a denial of service.

2092) Memory leak (CVE-ID: CVE-2026-90187)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to missing release of memory in the null_blk zoned device zones array when repeatedly powering a zoned device off and on. A local user can repeatedly power a zoned device off and on to cause a denial of service.

2093) Memory leak (CVE-ID: CVE-2026-90188)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in the null_blk module initialization error path when initializing null_blk with shared_tags enabled and device creation fails. A local user can trigger null_blk module initialization under these conditions to cause a denial of service.

2094) Use-after-free (CVE-ID: CVE-2026-90189)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to a use-after-free in the null_blk err_dev cleanup path when accessing a configfs item that remains reachable after cleanup. A local user can access the reachable configfs item to trigger a use-after-free condition.

Exploitation requires a racing user-created device to be added to the device list before module initialization enters error cleanup.

2095) Race condition (CVE-ID: CVE-2026-90189)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause block-device registration to fail.

The vulnerability exists due to a race condition in null_blk initialization when creating and powering on a configfs device during module initialization. A local user can race configfs device creation and power-on operations with module initialization to cause block-device registration to fail.

2096) Improper initialization (CVE-ID: CVE-2026-90190)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to improper initialization of a file-scope mutex in the null_blk driver when creating a configfs directory during null_blk initialization. A local user can race a mkdir operation with mutex initialization to trigger a kernel warning.

2097) Incomplete cleanup (CVE-ID: CVE-2026-90194)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to consume ACPI device instance IDs.

The vulnerability exists due to incomplete cleanup in the ACPI device registration rollback path when handling a failed device_add() operation. A local user can trigger a device_add() failure to consume ACPI device instance IDs.

2098) Integer overflow (CVE-ID: CVE-2026-90196)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in the SOF topology volume table handling when processing topology mixer control data. A local user can provide topology mixer control data with an oversized maximum value to cause a denial of service.

An inverted minimum and maximum volume range is also invalid.

2099) Use-after-free (CVE-ID: CVE-2026-90198)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to a use-after-free in snd_card_do_free() when a managed sound card is unbound while an application retains an open file descriptor. A local user can close the open file descriptor while the managed sound card is being unbound to trigger a use-after-free.

2100) Integer overflow (CVE-ID: CVE-2026-90199)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass validation of malformed NTFS attributes.

The vulnerability exists due to an integer overflow in mi_enum_attr() when processing malformed on-disk non-resident NTFS attributes. A local user can supply an attribute with an end virtual cluster number near U64_MAX to bypass validation of malformed NTFS attributes.

2101) Integer overflow (CVE-ID: CVE-2026-90200)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in MFT cluster validation in ntfs_init_from_boot() when mounting an NTFS volume with crafted boot-sector MFT cluster numbers. A local user can mount a crafted NTFS volume to cause a denial of service.

2102) NULL pointer dereference (CVE-ID: CVE-2026-90202)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the _base_release_memory_pools() function of the mpt3sas driver when releasing PCIe SGL buffers after a partial allocation failure. A local user can trigger memory-pool cleanup after a partial allocation failure to cause a denial of service.

2103) Memory corruption (CVE-ID: CVE-2026-90203)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds memory access.

The vulnerability exists due to improper validation of a negative block offset in squashfs_copy_data() when reading a crafted file from a mounted crafted Squashfs filesystem. A local user can read a crafted file with a negative offset to cause an out-of-bounds memory access.

Mounting the crafted Squashfs filesystem requires CAP_SYS_ADMIN.

2104) Race condition (CVE-ID: CVE-2026-90207)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the ALSA sequencer MIDI input event handler when closing a rawmidi substream while input events are being processed. A local user can trigger an input event during substream teardown to cause a denial of service.

2105) Deadlock (CVE-ID: CVE-2026-90209)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in the s390 debug subsystem's debug area unregistration handling when a debugfs file associated with a debug area is written concurrently with debug area unregistration. A local user can write to an associated debugfs file while debug area unregistration occurs to cause a denial of service.

2106) Memory leak (CVE-ID: CVE-2026-90213)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a memory leak.

The vulnerability exists due to improper resource cleanup in the FireWire core build_tree() function when processing an invalid self ID sequence. A remote attacker can cause processing of an invalid self ID sequence to cause a memory leak.

2107) Use-after-free (CVE-ID: CVE-2026-90214)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to improper error handling in xlnx_formatter_pcm_open() in the ASoC Xilinx formatter PCM driver when handling errors during PCM stream initialization. A local user can open a PCM stream that encounters a constraint setup error to trigger a use-after-free condition.

ALSA does not invoke the close callback when opening a stream fails.

2108) Incomplete cleanup (CVE-ID: CVE-2026-90216)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to leave UBI devices attached after failed module initialization.

The vulnerability exists due to incomplete cleanup in ubi_init_attach() when rolling back initialization after an mtd= parameter specifies an explicit UBI device number. A local privileged user can configure an explicit UBI device number and trigger a later initialization failure to leave UBI devices attached after failed module initialization.

2109) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-90218)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to improper handling of an error condition in the RDMA connection manager addr_handler() function when asynchronous address resolution fails to acquire an RDMA device. A local user can initiate asynchronous address resolution for which RDMA device acquisition fails to trigger a kernel warning.

2110) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-90219)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a resource leak.

The vulnerability exists due to missing release of debugfs resources in c4iw_dealloc() when RDMA device registration fails. A local user can trigger a failed RDMA device registration to cause a resource leak.

2111) Use of uninitialized resource (CVE-ID: CVE-2026-90221)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read uninitialized slab memory.

The vulnerability exists due to improper length validation in the nci_core_init_rsp_packet_v1() and nci_core_init_rsp_packet_v2() CORE_INIT_RSP parsers when processing a malformed CORE_INIT_RSP packet injected through virtual_ncidev. A local user can inject a malformed response with an inflated number of supported RF interfaces to read uninitialized slab memory.

2112) Use-after-free (CVE-ID: CVE-2026-90222)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the PN533 NFC driver send path when command completion races frame transmission. A local user can trigger the race condition to cause a denial of service.

2113) Out-of-bounds read (CVE-ID: CVE-2026-90223)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in nfc_llcp_recv_snl() when processing malformed SNL TLVs. A remote attacker can send a malformed SNL frame to perform an out-of-bounds read.

LLCP link activation occurs automatically after NFC-DEP.

2114) Use-after-free (CVE-ID: CVE-2026-90224)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to a race condition in nci_data_exchange_complete when concurrently closing an NCI device and processing received data. A local user can race device closure with received-data processing to trigger a use-after-free condition.

2115) Use-after-free (CVE-ID: CVE-2026-90225)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in nfc_llcp_getsockopt() when racing a getsockopt call with an in-flight bind operation. A local user can invoke getsockopt() while bind() modifies and frees the cached local pointer to trigger a use-after-free condition.

2116) Out-of-bounds write (CVE-ID: CVE-2026-90226)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write past a user-supplied buffer.

The vulnerability exists due to improper validation of option-buffer length in nfc_llcp_getsockopt() when handling getsockopt calls with an option length smaller than four bytes. A local user can supply an option buffer with an option length smaller than four bytes to write past a user-supplied buffer.

The issue affects all five supported option names.

2117) Missing Authorization (CVE-ID: CVE-2026-90227)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write data despite read-only access restrictions.

The vulnerability exists due to missing authorization in the NVME_IOCTL_SUBMIT_IO ioctl handler when submitting NVMe I/O commands. A local user can invoke the ioctl with a crafted I/O command to write data despite read-only access restrictions.

2118) NULL pointer dereference (CVE-ID: CVE-2026-90228)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in nvmet_execute_identify_ns_zns() when processing a host-supplied Identify command with CNS 05h and CSI 02h targeting a file-backed namespace. A remote attacker can send a crafted Identify command targeting a file-backed namespace to cause a denial of service.

The issue is reachable only when CONFIG_BLK_DEV_ZONED is enabled.

2119) Use-after-free (CVE-ID: CVE-2026-90229)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the Apple NVMe driver's admin queue during controller removal when a controller fails to initialize and is immediately torn down. A local user can trigger the affected controller removal sequence to cause a denial of service.

2120) Out-of-bounds read (CVE-ID: CVE-2026-90230)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read memory beyond an allocated buffer.

The vulnerability exists due to a heap out-of-bounds read in nvmet_auth_negotiate() when processing host-supplied DH-HMAC-CHAP negotiation messages. A remote attacker can send a negotiation message with a truncated transfer length or oversized hash or DH group identifier lists to read memory beyond an allocated buffer.

2121) Race condition (CVE-ID: CVE-2026-90235)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger invocation of stale socket callbacks.

The vulnerability exists due to improper synchronization in SUNRPC xprtsock socket callback handling when concurrent socket callback handling occurs during teardown. A remote attacker can race callback processing with socket teardown to trigger invocation of stale socket callbacks.

The issue applies when SUNRPC takes over AF_LOCAL, UDP, or TCP sockets.

2122) Integer overflow (CVE-ID: CVE-2026-90245)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect overlay viewport register configuration.

The vulnerability exists due to integer overflow in the kyro framebuffer driver's overlay viewport coordinate calculations when processing oversized overlay viewport coordinates. A local user can supply oversized viewport coordinate values to cause incorrect overlay viewport register configuration.

2123) Race condition (CVE-ID: CVE-2026-90248)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to silently unlink an active traffic classifier.

The vulnerability exists due to improper ownership tracking in tc_new_tfilter() when handling concurrent traffic-control filter insertions. A local user can race another request to insert a traffic-control filter at the same chain and priority to silently unlink an active traffic classifier.

2124) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-90249)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper runtime power-management reference handling in the gp2ap002_write_event_config() function when writing duplicate event enable values. A local user can write the same event enable state twice to cause a denial of service.

2125) NULL pointer dereference (CVE-ID: CVE-2026-90250)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the cgroup BPF program replacement logic when replacing an attached cgroup BPF program through link_update. A local user can replace an empty attached program with a program that uses per-CPU cgroup storage to cause a denial of service.

2126) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-90251)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 0 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause the kernel to read data beyond the controller response.

The vulnerability exists due to improper validation of an event prefix length in the Bluetooth MSFT read_supported_features() handler when handling an MSFT read supported features response from a Bluetooth controller. A remote attacker can provide a response whose declared event-prefix length exceeds its actual length to cause the kernel to read data beyond the controller response.

The copied data is later used to match incoming vendor events.

2127) Memory leak (CVE-ID: CVE-2026-90253)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource cleanup in the Bluetooth MGMT mesh send cancel command handler when a pending mesh send cancel command is cancelled. A local user can cause a pending mesh send cancel command to be cancelled to cause a denial of service.

2128) Memory leak (CVE-ID: CVE-2026-90254)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to improper release of memory in Bluetooth HCI synchronous command queue handling when an advertising timeout expires and a command cannot be queued or a pending entry is canceled. A local user can trigger advertising timeout handling under these conditions to cause a memory leak.

2129) Use-after-free (CVE-ID: CVE-2026-90255)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to use-after-free in Bluetooth hci_conn SCO setup handling when queued synchronous setup work accesses a connection after it is freed. A local user can trigger queued SCO setup work that accesses a freed connection to cause a use-after-free condition.

Queued context entries can be canceled before execution, including when the controller is unregistered.

2130) Out-of-bounds read (CVE-ID: CVE-2026-90257)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in virtbt_setup_zephyr() when processing a status-only Read Build Information response from a Bluetooth virtio backend. A local user can provide a response containing only a status byte to disclose sensitive information.

Adjacent slab memory bytes may be exposed through the kernel log and the firmware-info debugfs file.

2131) Improper handling of exceptional conditions (CVE-ID: CVE-2026-90262)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of read errors in btrfs_read_merkle_tree_page() when reading Merkle tree pages after a transient read failure. A local user can trigger subsequent reads of Merkle tree data to cause a denial of service.

2132) Integer underflow (CVE-ID: CVE-2026-90274)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds memory access.

The vulnerability exists due to an integer underflow in the ETM4x CoreSight trace driver when handling sequencer state transition controls. A local user can configure sequence state controls to trigger an out-of-bounds memory access.

The issue occurs on trace units for which TRCIDR5.NUMSEQSTATE is zero.

2133) Improper initialization (CVE-ID: CVE-2026-90275)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the Linux kernel md/raid1 raid1_takeover() function when initiating a RAID1 array takeover. A local user can initiate a RAID1 array takeover to cause a denial of service.

2134) Incorrect calculation (CVE-ID: CVE-2026-90279)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect RAID5 bitmap sector mapping.

The vulnerability exists due to improper rounding arithmetic in raid5_bitmap_sector() when processing a write range with a non-power-of-two full RAID5 stripe width. A local user can issue a one-sector write at a full-stripe boundary to cause incorrect RAID5 bitmap sector mapping.

2135) NULL pointer dereference (CVE-ID: CVE-2026-90280)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the QMP USB PHY runtime suspend and resume callbacks when runtime power management is re-enabled before the PHY is initialized. A local user can re-enable runtime power management through the sysfs attribute to cause a denial of service.

The issue may also occur during the interval after pm_runtime_enable() and before pm_runtime_forbid().

2136) NULL pointer dereference (CVE-ID: CVE-2026-90281)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the Qualcomm SNPS Femto v2 PHY driver's runtime PM callbacks when a runtime suspend callback runs during PHY initialization. A local user can trigger a runtime suspend callback before the PHY instance is ready to cause a denial of service.

2137) NULL pointer dereference (CVE-ID: CVE-2026-90282)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the runtime suspend and resume callbacks of the Qualcomm QMP USB legacy PHY driver when runtime power management executes before PHY initialization. A local user can re-enable runtime power management through the sysfs attribute before the PHY is initialized to cause a denial of service.

2138) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-90283)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause huge page reservations to remain charged.

The vulnerability exists due to improper resource cleanup in the hugetlbfs_fill_super() failure path when initiating a hugetlbfs mount with size or min_size options and root dentry creation fails. A local user can trigger the mount failure path to cause huge page reservations to remain charged.

2139) Race condition (CVE-ID: CVE-2026-90284)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the firmware sysfs fallback loader when a userspace helper completes a firmware request after the loading interface is exposed but before the request is added to the pending request list. A local user can write 0 to the loading attribute to cause a denial of service.

2140) Race condition (CVE-ID: CVE-2026-90285)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger concurrent flash access operations.

The vulnerability exists due to improper synchronization in qla2x00_sysfs_read_vpd() in the qla2xxx driver when reading VPD data through sysfs while concurrent optrom operations are occurring. A local user can read VPD data through sysfs during concurrent optrom operations to trigger concurrent flash access operations.

2141) Race condition (CVE-ID: CVE-2026-90286)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause GPU command submissions to execute out of order.

The vulnerability exists due to improper synchronization in the AMDGPU GFX6 compute queue handling when submitting GPU compute workloads. A local user can submit GPU compute workloads to cause GPU command submissions to execute out of order.

GFX6 compute queues share the command processing path used by graphics queues.

2142) Improper resource shutdown or release (CVE-ID: CVE-2026-90287)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak clock and reset resources.

The vulnerability exists due to improper resource shutdown or release in sp_uphy_init() when handling USB PHY initialization failures. A local user can trigger a USB PHY initialization failure to leak clock and reset resources.

2143) Improper handling of exceptional conditions (CVE-ID: CVE-2026-90290)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper handling of exceptional conditions in swsusp_arch_suspend() when handling a failure from swsusp_mte_save_tags(). A local privileged user can trigger the hibernation error path to cause a denial of service.

2144) Use-after-free (CVE-ID: CVE-2026-90291)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to improper lifetime management in the kmod dups code when duplicate module requests retain a kmod_dup_req instance across a blocking wait. A local user can issue duplicate module requests while another request is waiting for modprobe completion to trigger a use-after-free condition.

2145) Use-after-free (CVE-ID: CVE-2026-90292)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to improper reference counting in the RDMA/siw siw_accept() function when handling a userspace-supplied queue pair that is already in the RTS state. A local user can supply such a queue pair to cause a use-after-free condition.

2146) Race condition (CVE-ID: CVE-2026-90293)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a race condition in the iSER target login receive-buffer handling when processing a SCSI command before the final Login Response. A remote attacker can send a SCSI command before receiving the final Login Response to cause a denial of service.

2147) Race condition (CVE-ID: CVE-2026-90294)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a race condition in iSER target login-response handling when an initiator submits a SCSI command immediately after receiving the final Login Response. A remote attacker can send a specially timed SCSI command to cause a denial of service.

2148) Out-of-bounds write (CVE-ID: CVE-2026-90295)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in the imx6q cpufreq driver when probing the driver after it has been unbound. A local user can rebind the driver to cause memory corruption.

2149) Memory leak (CVE-ID: CVE-2026-90296)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in the imx6q cpufreq driver when rebinding the driver. A local user can repeatedly rebind the driver to cause a denial of service.

2150) NULL pointer dereference (CVE-ID: CVE-2026-90297)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in sun4i_crtc_init() when initializing display layers. A local user can trigger a layer initialization failure to cause a denial of service.

2151) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-90298)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak device references.

The vulnerability exists due to improper resource release in the sun8i_r40_tcon_tv_set_mux function when configuring the TCON TV multiplexer. A local user can trigger TCON TV multiplexer configuration to leak device references.

2152) Use-after-free (CVE-ID: CVE-2026-90302)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the OCFS2 o2net heartbeat callback handling when local-node teardown overlaps heartbeat node-down callback processing. A local user can initiate local-node teardown during heartbeat callback processing to cause a denial of service.

2153) Use-after-free (CVE-ID: CVE-2026-90303)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in show_pte() when handling user faults concurrently with munmap() calls. A local user can trigger a user fault while another thread in the same process calls munmap() to cause a denial of service.

Exploitation requires CONFIG_DEBUG_USER=y and the user_debug=31 command-line setting.

2154) Out-of-bounds read (CVE-ID: CVE-2026-90307)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the SRP response-processing handlers when processing truncated SRP requests. A remote attacker can send a crafted truncated SRP_CRED_REQ or SRP_AER_REQ to disclose sensitive information.

Exploitation requires an SRP target to advertise a small max_ti_iu_len value during login.

2155) Use-after-free (CVE-ID: CVE-2026-90308)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in RDMA/erdma QP handling when AE QP fatal events or iWARP CM paths process QPs concurrently with QP destruction. A local user can cause a QP to be destroyed while AE or CM processing is in progress to cause a denial of service.

2156) Use-after-free (CVE-ID: CVE-2026-90309)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the ERDMA completion queue handling when EQ handlers invoke completion or error callbacks after a completion queue has been destroyed. A local user can race completion queue destruction with EQ event processing to cause a denial of service.

2157) Use-after-free (CVE-ID: CVE-2026-90313)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an invalid memory access.

The vulnerability exists due to use-after-free in __cgroup_bpf_attach when replacing a cgroup BPF program in multi-attach mode and the attachment fails midway. A local user can perform a failed BPF_F_REPLACE operation and attach another cgroup BPF program to trigger an invalid memory access.

The issue requires an active replaced program with local storage to execute bpf_get_local_storage after the failed attachment.

2158) Out-of-bounds read (CVE-ID: CVE-2026-90314)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read memory out of bounds.

The vulnerability exists due to improper signedness handling in rsc_table_for_each_entry() when processing a firmware resource table. A local user can provide a crafted firmware resource table containing an offset interpreted as negative to read memory out of bounds.

2159) Use-after-free (CVE-ID: CVE-2026-90316)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in OMAP DSI interrupt service routine table handling when unregistering interrupts while they are being handled. A local user can unregister interrupts during interrupt handling to trigger a use-after-free condition.

2160) Improper resource shutdown or release (CVE-ID: CVE-2026-90318)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a resource leak.

The vulnerability exists due to improper resource release in fat_rebuild_parent() when rebuilding parent inodes through the nostale_ro NFS export path. A remote user can trigger parent inode reconstruction without releasing the buffer head to cause a resource leak.

2161) Use-after-free (CVE-ID: CVE-2026-90319)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the RapidIO rio_scan_alloc_net() failure path when handling a rio_add_net() failure. A local user can trigger a subsequent mport unregister path to dereference a dangling mport->net pointer and attempt to free the rio_net object again.

2162) Out-of-bounds read (CVE-ID: CVE-2026-90322)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read out-of-bounds memory.

The vulnerability exists due to an invalid node number being used as a heartbeat slot index in the OCFS2 heartbeat subsystem when resetting the local node configuration while heartbeat threads are running. A local user can reset the local node configuration while heartbeat threads are running to read out-of-bounds memory.

2163) Use-after-free (CVE-ID: CVE-2026-90325)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to a use-after-free in blkcg_activate_policy() when switching I/O schedulers concurrently with blkcg deletion. A local user can race scheduler switching with blkcg deletion to trigger a use-after-free condition.

2164) Out-of-bounds write (CVE-ID: CVE-2026-90327)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write up to three bytes beyond a user-supplied buffer.

The vulnerability exists due to an out-of-bounds write in the phonet PEP socket option handler pep_getsockopt() when calling getsockopt() with an optlen smaller than sizeof(int). A local user can invoke getsockopt() with a small optlen to write up to three bytes beyond a user-supplied buffer.

2165) Use-after-free (CVE-ID: CVE-2026-90329)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to a use-after-free in HID failed-probe cleanup when a HID report callback runs concurrently with a failed device probe. A local user can cause a HID report to be processed while a device probe fails to trigger a use-after-free.

2166) Use-after-free (CVE-ID: CVE-2026-90334)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to use-after-free in tty_cdev_add() when handling a cdev_add() failure. A local user can trigger tty device unregistration after cdev_add() fails to cause a use-after-free.

2167) Integer overflow (CVE-ID: CVE-2026-90341)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access memory outside the platform resource.

The vulnerability exists due to integer overflow and insufficient bounds validation in coreboot_table_probe() when processing a malformed coreboot table. A local user can supply a malformed coreboot table to access memory outside the platform resource.

2168) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-90348)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper handling of device-memory mappings in ath10k_msa_dump_memory() when collecting an MSA firmware crash dump. A local privileged user can cause firmware crash dump collection to cause a denial of service.

2169) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-90352)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a resource leak.

The vulnerability exists due to failure to release a resource in the mt7915 PCI probe routine when IRQ vector allocation or primary IRQ request setup fails. A local privileged user can initiate probing of an mt7915 PCI device under an IRQ setup failure condition to cause a resource leak.

2170) Use-after-free (CVE-ID: CVE-2026-90353)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise system confidentiality, integrity, and availability.

The vulnerability exists due to use-after-free in the mt7915 wireless driver's registration error path when main PHY debugfs initialization or coredump registration fails after successful external PHY registration. A local user can exploit the external PHY hardware object being freed while still registered with mac80211 to compromise system confidentiality, integrity, and availability.

The error cleanup calls mt76_unregister_device(), which unregisters only the main hardware object.

2171) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-90354)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a device reference leak.

The vulnerability exists due to improper resource management in the mt7915_pci_probe HIF2 initialization path when initializing HIF2 on non-WED dual-HIF hardware. A local user can trigger initialization of the mt7915 PCI device to cause a device reference leak.

2172) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-90357)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel driver state.

The vulnerability exists due to improper resource lifecycle management in the mt7915 TWT flow list when handling a TWT agreement rejected by the MCU. A local user can trigger a rejected TWT agreement to corrupt kernel driver state.

A reused flow slot can remain linked in the TWT list, leaving a dangling entry that is later traversed.

2173) Stack-based buffer overflow (CVE-ID: CVE-2026-90358)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to overwrite adjacent stack slots.

The vulnerability exists due to a stack-based buffer overflow in the x86 BPF trampoline register save area when handling a 128-bit scalar function argument. A local user can trigger a BPF trampoline with a 128-bit scalar argument to overwrite adjacent stack slots.

2174) Race condition (CVE-ID: CVE-2026-90360)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning during system suspend.

The vulnerability exists due to a race condition involving a non-freezable workqueue in the regulator core when delayed regulator cleanup runs concurrently with system suspend. A local user can cause system suspend to overlap with delayed regulator cleanup to trigger a kernel warning during system suspend.

The cleanup work runs approximately 30 seconds after boot to disable unused regulators via I2C. If the I2C adapter is already suspended, the transfer triggers a -ESHUTDOWN warning in __i2c_transfer().

2175) Memory leak (CVE-ID: CVE-2026-90361)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory cleanup in ath11k_service_ready_ext_event() when parsing service-ready extension TLVs. A local user can cause parsing to fail after mac_phy_caps has been allocated to cause a denial of service.

2176) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-90362)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause the DSI link clock to run without necessary power backing.

The vulnerability exists due to improper power-state management in dsi_link_clk_disable_6g() when disabling DSI link clocks. A local user can trigger the DSI link clock disable path to cause the DSI link clock to run without necessary power backing.

2177) Incomplete cleanup (CVE-ID: CVE-2026-90364)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to leave a cpufreq policy notifier registered after ACPI processor driver initialization fails.

The vulnerability exists due to incomplete cleanup in acpi_processor_driver_init() when ACPI processor driver initialization fails after registering the cpufreq policy notifier. A local privileged user can trigger an initialization failure to leave a cpufreq policy notifier registered.

2178) Incorrect Calculation of Buffer Size (CVE-ID: CVE-2026-90366)

CWE-ID: CWE-131 - Incorrect Calculation of Buffer Size

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an incorrect buffer size calculation in the MT7996 beacon update size calculation when processing a beacon update while a CSA countdown is active. A local privileged user can trigger the emission of two bss_bcn_cntdwn_tlv entries to cause a denial of service.

Exploitation requires MBSSID to be enabled and a near-maximum beacon template.

2179) Use-after-free (CVE-ID: CVE-2026-90368)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to dereference a stale monitor_vif pointer.

The vulnerability exists due to use-after-free in mt7915_add_interface() when mt76_wcid_alloc() fails during interface addition. A local user can trigger a failed interface addition to dereference a stale monitor_vif pointer.

mac80211 does not call remove_interface() when interface addition fails.

2180) Infinite loop (CVE-ID: CVE-2026-90370)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper validation of TLV lengths in mt7996_mcu_get_chip_config when parsing a firmware response during device probe. A local user can provide a firmware response containing a zero-length TLV to cause a denial of service.

2181) Integer underflow (CVE-ID: CVE-2026-90372)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an out-of-range spatial-stream value to be written to firmware beamforming fields.

The vulnerability exists due to an integer underflow in mt7915_mcu_get_sta_nss when processing a peer VHT/HE MCS map with no supported spatial streams. A remote attacker can advertise a crafted VHT/HE MCS map to cause an out-of-range spatial-stream value to be written to firmware beamforming fields.

2182) Out-of-bounds read (CVE-ID: CVE-2026-90374)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an out-of-bounds memory access.

The vulnerability exists due to improper validation of an array index in the mt7996_mac_fill_rx RX handler when processing a received descriptor with a corrupt or reserved band index. A remote attacker can supply a received descriptor with a corrupt or reserved band index to cause an out-of-bounds memory access.

2183) Incorrect calculation (CVE-ID: CVE-2026-90375)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 5.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to incorrect non-AQL packet accounting in __mt76_tx_queue_skb() when transmitting frames through a non-setup multi-link operation link. A remote user can transmit a frame using a link different from the station's setup link to cause a denial of service.

2184) Memory leak (CVE-ID: CVE-2026-90378)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to improper memory management in the mt76 SDIO transmit path when tx_prepare_skb() returns an error while processing zero-length frames. A local user can submit a zero-length frame to cause a memory leak.

2185) Reachable assertion (CVE-ID: CVE-2026-90382)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a kernel panic and denial of service.

The vulnerability exists due to a reachable assertion in the mt76x02 receive-processing path when processing a corrupted wireless frame with a receive descriptor length larger than the received buffer. A remote attacker can transmit a corrupted over-the-air frame to cause a kernel panic and denial of service.

Exploitation requires monitor mode with the fcsfail filter enabled and panic_on_warn set.

2186) Race condition (CVE-ID: CVE-2026-90383)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an unsafe page-table walk.

The vulnerability exists due to improper synchronization in the GRU TLB miss handler when handling a GRU TLB miss in interrupt context. A local user can trigger a GRU TLB miss to trigger an unsafe page-table walk.

2187) Improper initialization (CVE-ID: CVE-2026-90385)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper initialization in the md/raid1 serial pool creation logic when adding a new rdev to an existing RAID1 array with serialize policy enabled. A local privileged user can add a new rdev to a configured RAID1 array to cause a denial of service.

2188) Incorrect Bitwise Shift of Integer (CVE-ID: CVE-2026-90386)

CWE-ID: CWE-1335 - Incorrect Bitwise Shift of Integer

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a shift-out-of-bounds condition.

The vulnerability exists due to an incorrect bitwise shift calculation in the DesignWare I3C master DAA handler when ENTDAA assigns no devices on an empty I3C bus. A local user can initiate dynamic address assignment on an empty I3C bus to trigger a shift-out-of-bounds condition.

2189) Release of invalid pointer or reference (CVE-ID: CVE-2026-90387)

CWE-ID: CWE-763 - Release of invalid pointer or reference

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to release of an invalid pointer in the swiotlb dynamic-pool allocation and free handling when allocating a decrypted pool from the DMA atomic pool in atomic context with CONFIG_DMA_DIRECT_REMAP enabled. A local user can trigger dynamic swiotlb pool allocation to cause a memory leak.

The atomic pool can use remapped virtual addresses that differ from direct-map addresses.

2190) Unchecked Return Value (CVE-ID: CVE-2026-90388)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an IOMMU mapping to be attempted after an allocation failure.

The vulnerability exists due to improper check of an allocation return value in iommu_dma_alloc when executing the non-blocking, non-coherent allocation path. A local user can invoke the affected allocation path during an allocation failure to cause an IOMMU mapping to be attempted after an allocation failure.

The affected path requires CONFIG_DMA_DIRECT_REMAP and non-coherent allocation.

2191) Race condition (CVE-ID: CVE-2026-90389)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in MD array suspension handling when concurrent sysfs writes suspend an array. A local user can issue concurrent writes to the suspend_lo and suspend_hi sysfs attributes to cause a denial of service.

2192) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-90390)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in the md bitmap backlog_store() function when attempting to set backlog on an array without a write-mostly device. A local user can trigger the error path to cause a denial of service.

2193) Infinite loop (CVE-ID: CVE-2026-90391)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in dmirror_fault() in lib/test_hmm.c when handling dmirror read or write ioctl operations after the mirrored mm has exited. A local user can issue dmirror read or write ioctl operations to cause a denial of service.

The loop is reached after a missing device page table entry is encountered.

2194) Use-after-free (CVE-ID: CVE-2026-90392)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in bpf_link_show_fdinfo and bpf_link_get_info_by_fd when reading BPF link information while a linked program is concurrently replaced via bpf_link_update. A local user can concurrently replace a linked program and read BPF link information to trigger a use-after-free condition.

2195) Use-after-free (CVE-ID: CVE-2026-90393)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to a race condition in bpf_netns_link_update_prog when concurrently executing BPF_LINK_UPDATE operations on the same network namespace link. A local user can race program updates to trigger a use-after-free condition.

2196) Use-after-free (CVE-ID: CVE-2026-90394)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access freed driver data.

The vulnerability exists due to use-after-free in the sc2731_charger driver's remove path when queued or running work executes after driver data is released. A local user can cause the driver to be removed while work remains queued or running to access freed driver data.

2197) Use-after-free (CVE-ID: CVE-2026-90395)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to access freed power supply state.

The vulnerability exists due to a use-after-free in the isp1704 charger driver's remove path when queued or running work executes during device removal. A local privileged user can cause work scheduled by USB notification or initial VBUS detection to execute after the power supply state is torn down to access freed power supply state.

2198) NULL pointer dereference (CVE-ID: CVE-2026-90397)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the Qualcomm SCM driver when processing IRQs or non-atomic SMC calls during driver probe. A local user can trigger the affected probe-time paths to cause a denial of service.

2199) Out-of-bounds write (CVE-ID: CVE-2026-90398)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write beyond an allocated buffer.

The vulnerability exists due to an allocation size and pointer stride mismatch in ath11k_wmi_tlv_mac_phy_caps_parse() when processing short firmware TLVs. A local user can cause the kernel to process short firmware TLVs to write beyond an allocated buffer.

2200) Out-of-bounds write (CVE-ID: CVE-2026-90399)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an allocation-size and pointer-stride mismatch in ath12k_wmi_mac_phy_caps_parse() when processing short firmware TLVs. A local user can trigger an out-of-bounds write to cause memory corruption.

2201) Race condition (CVE-ID: CVE-2026-90400)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a race condition in the md_start_sync() RAID synchronization path when spare configuration changes occur concurrently with normal I/O. A local privileged user can cause spare configuration changes to race with normal I/O to cause a denial of service.

The race can cause rdev_dec_pending() to be called with a NULL pointer.

2202) Incomplete cleanup (CVE-ID: CVE-2026-90403)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise system confidentiality, integrity, and availability.

The vulnerability exists due to incomplete cleanup caused by an incorrect goto label in the rtl_pci_probe() function when handling an IRQ handler registration failure. A local user can trigger this error path to compromise system confidentiality, integrity, and availability.

2203) Use-after-free (CVE-ID: CVE-2026-90404)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the cros_ec_debugfs remove path when an EC panic notification is delivered after the device instance has been removed. A local user can trigger an EC panic notification after device removal to cause a denial of service.

The callback can queue work that accesses released data.

2204) Out-of-bounds read (CVE-ID: CVE-2026-90407)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in ath11k_wmi_process_csa_switch_count_event() when processing a firmware CSA switch count event. A local user can provide a crafted firmware event with an unchecked num_vdevs value to read out-of-bounds memory.

2205) Use-after-free (CVE-ID: CVE-2026-90410)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the Davinci SPI driver's interrupt handler when processing a late or latched interrupt during device removal. A local user can initiate device removal while such an interrupt is handled to cause a denial of service.

2206) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-90411)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a DMA mapping resource leak.

The vulnerability exists due to improper resource cleanup in __nvme_fc_init_request() when handling a response IU DMA mapping failure. A local user can trigger request initialization with a response IU DMA mapping failure to cause a DMA mapping resource leak.

2207) Out-of-bounds read (CVE-ID: CVE-2026-90413)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in the iSER login PDU handling code when processing a login PDU whose declared data segment length exceeds the received payload length. A remote attacker can send a crafted login PDU with an oversized declared data segment length to read out-of-bounds memory.

The issue can be triggered before authentication.

2208) Out-of-bounds read (CVE-ID: CVE-2026-90414)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause an out-of-bounds read and write heap contents beyond the receive descriptor to backing storage.

The vulnerability exists due to missing validation of the declared data segment length in isert_recv_done() when processing iSER/iSCSI PDUs. A remote user can send a PDU that declares a data segment larger than the received data to cause an out-of-bounds read and write heap contents beyond the receive descriptor to backing storage.

Exploitation requires the full feature phase and negotiated parameters that permit unsolicited or immediate data.

2209) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-90415)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the RDMA/cxgb4 write_tpt_entry() function when programming a TPT entry. A local user can trigger a failed TPT entry write to cause a denial of service.

2210) Out-of-bounds read (CVE-ID: CVE-2026-90416)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the get_param() function of the cc_params debugfs interface when reading a congestion parameter. A local user can read a crafted congestion parameter value through the debugfs interface to disclose sensitive information.

The issue is triggered when the parameter value has bit 31 set.

2211) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-90418)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of an inconsistent dirty state in nilfs_copy_dirty_pages() when copying dirty DAT folios or pages to the shadow page cache. A local user can trigger the dirty-state mismatch to cause a denial of service.

The condition can occur after metadata corruption causes the filesystem to transition to read-only mode.

2212) Out-of-bounds read (CVE-ID: CVE-2026-90419)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds read.

The vulnerability exists due to improper input validation in nilfs2 super-root block parsing when processing a malformed filesystem image. A local user can supply a malformed filesystem image to perform an out-of-bounds read.

2213) Infinite loop (CVE-ID: CVE-2026-90420)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of terminal errors in nilfs_clean_segments() when the cleaner ioctl encounters repeated -EROFS errors from nilfs_segctor_construct(). A local user can invoke the cleaner ioctl to cause a denial of service.

The issue can occur when the device is remounted read-only after an I/O error.

2214) Use-after-free (CVE-ID: CVE-2026-90431)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the remoteproc crash-handler work when crash reporting races with remoteproc deletion. A local user can trigger concurrent crash reporting and remoteproc removal to cause a denial of service.

2215) Use-after-free (CVE-ID: CVE-2026-90433)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to improper resource lifetime management in the tiny_spi_irq() interrupt handler when handling a late or latched interrupt during device removal. A local user can cause the interrupt handler to access freed controller memory to cause a use-after-free condition.

2216) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-90434)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to exhaust buffer-head resources.

The vulnerability exists due to failure to release a buffer-head reference in zisofs_fill_pages() when successfully reading compressed block pointer tables. A local user can cause zisofs_fill_pages() to read compressed block pointer tables to exhaust buffer-head resources.

2217) Integer overflow (CVE-ID: CVE-2026-90435)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to integer overflow in the mlx5 RDMA driver's set_user_buf_size() function when processing user-supplied QP buffer parameters. A local user can supply an excessively large rq.wqe_cnt value to cause memory corruption.

The same unchecked shift calculation is also used to compute qp->sq.offset during user QP creation.

2218) Use of uninitialized resource (CVE-ID: CVE-2026-92476)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger use of an uninitialized completion.

The vulnerability exists due to use of an uninitialized resource in the Keem Bay OCS AES driver's kmb_ocs_aes_probe() routine when a device interrupt occurs after IRQ registration and before completion initialization. A local user can trigger a device interrupt during this initialization window to trigger use of an uninitialized completion.

2219) Improper Null Termination (CVE-ID: CVE-2026-92477)

CWE-ID: CWE-170 - Improper Null Termination

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read.

The vulnerability exists due to improper null termination in ufs_saved_err_write() when handling a write that fills the input buffer. A local user can write input that fills the stack buffer to cause an out-of-bounds read.

2220) Use-after-free (CVE-ID: CVE-2026-92481)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a use-after-free in the MediaTek EINT interrupt resource cleanup when unbinding a module. A local privileged user can unbind a MediaTek pinctrl module, leaving a chained interrupt handler referencing freed data, to cause a denial of service.

2221) Use-after-free (CVE-ID: CVE-2026-92484)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access freed memory.

The vulnerability exists due to use-after-free in the CXL region find_pos_and_ways() function when reporting an error after releasing a switch decoder reference. A local user can cause an error that logs the decoder name after its reference is released to access freed memory.

2222) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-92488)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource cleanup in the ERDMA RDMA object destruction functions when a destroy command fails. A local user can destroy an RDMA object after a command failure to cause a denial of service.

A command timeout permanently disables the command queue, preventing retries.

2223) Double free (CVE-ID: CVE-2026-92489)

CWE-ID: CWE-415 - Double Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a double-free.

The vulnerability exists due to a double free in xfrm_dev_direct_output() when handling packets dropped by netfilter. A local user can send a packet that is dropped by netfilter to trigger a double-free.

2224) Use-after-free (CVE-ID: CVE-2026-92490)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in the SCMI driver registration handling in scmi_driver_register() when driver registration fails. A local user can cause a driver registration failure and subsequently trigger request matching or SCMI device creation to trigger a use-after-free condition.

2225) Memory leak (CVE-ID: CVE-2026-92494)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a buffer_head reference leak.

The vulnerability exists due to improper resource release in ext4_init_orphan_info() when processing orphan file blocks with an invalid magic value or checksum. A local user can cause ext4_init_orphan_info() to process such orphan file blocks to cause a buffer_head reference leak.

2226) Incorrect permission assignment for critical resource (CVE-ID: CVE-2026-92495)

CWE-ID: CWE-732 - Incorrect Permission Assignment for Critical Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain unintended write access to DBR or toggle pages.

The vulnerability exists due to improper permission assignment in bnxt_re_mmap when changing a read-only DBR or toggle page mapping to writable with mprotect. A local user can retain VM_MAYWRITE on the mapping to gain unintended write access to DBR or toggle pages.

2227) Out-of-bounds read (CVE-ID: CVE-2026-92496)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in ath11k_wmi_tlv_op_rx() when processing a firmware buffer shorter than a WMI command header. A local user can supply a malformed firmware buffer to read out-of-bounds memory.

2228) Out-of-bounds read (CVE-ID: CVE-2026-92497)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause an out-of-bounds read.

The vulnerability exists due to improper bounds checking in ath12k_wmi_op_rx() when processing a firmware buffer that is shorter than a WMI command header. A local privileged user can cause the function to access header data in an undersized firmware buffer to cause an out-of-bounds read.

2229) Out-of-bounds read (CVE-ID: CVE-2026-92498)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read beyond the bounds of WMI event buffers.

The vulnerability exists due to an out-of-bounds read in ath6kl WMI event handlers when processing undersized WMI events. A remote attacker can provide a malformed WMI event to read beyond the bounds of event buffers.

2230) Race condition (CVE-ID: CVE-2026-92501)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in ext4_buffered_write_iter() when a direct I/O write falls back to buffered I/O while concurrent direct I/O completes. A local user can issue concurrent direct I/O operations to cause a denial of service.

The issue can also occur when non-overlapping direct I/O writes share a large folio and the block size is smaller than the folio size.

2231) Improper resource shutdown or release (CVE-ID: CVE-2026-92504)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a resource leak.

The vulnerability exists due to improper resource cleanup in the int3400 thermal driver's ODVP handling when driver probing fails after evaluate_odvp() has created ODVP sysfs files. A local user can trigger a driver probe failure after ODVP evaluation to cause a resource leak.

2232) Double free (CVE-ID: CVE-2026-92506)

CWE-ID: CWE-415 - Double Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in scmi_protocol_device_unrequest() when two SCMI drivers for the same protocol unregister concurrently. A local user can trigger concurrent unregistration of the drivers to cause a denial of service.

2233) Use-after-free (CVE-ID: CVE-2026-92507)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially trigger a use-after-free.

The vulnerability exists due to use-after-free in ib_dealloc_pd_user() RDMA resource tracking when accessing a protection domain through the netlink path during its destruction. A local user can access a protection domain through the netlink path while it is being destroyed to potentially trigger a use-after-free.

2234) Use-after-free (CVE-ID: CVE-2026-92508)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to a use-after-free in the RDMA/core ib_free_cq() completion queue destruction function when accessing a completion queue through the netlink path while it is being destroyed. A local user can access a completion queue through netlink during its destruction to trigger a use-after-free condition.

2235) Use-after-free (CVE-ID: CVE-2026-92509)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in counter_release() in the RDMA core counter handling when processing netlink access to a counter during its destruction. A local user can access a counter through the netlink path while it is being released to trigger a use-after-free condition.

2236) Use-after-free (CVE-ID: CVE-2026-92510)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to a use-after-free in the SRQ resource-tracking lifecycle in ib_destroy_srq_user() when accessing a shared receive queue through the netlink path during destruction. A local user can access a shared receive queue that remains accessible through restrack while its vendor-specific resources are being released to trigger a use-after-free.

2237) Use-after-free (CVE-ID: CVE-2026-92511)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to a use-after-free in ib_destroy_cq_user() when accessing a completion queue through the netlink path during its destruction. A local user can access a completion queue through netlink while it is being destroyed to trigger a use-after-free condition.

2238) Use-after-free (CVE-ID: CVE-2026-92512)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a kernel crash.

The vulnerability exists due to use-after-free in ib_query_qp() when querying a queue pair through the RDMA netlink flow while the queue pair is being destroyed. A local user can send a netlink request to query the queue pair during its destruction to cause a kernel crash.

2239) Use-after-free (CVE-ID: CVE-2026-92514)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ERDMA completion event queue tasklet when removing an ERDMA device. A local user can trigger device removal while a previously scheduled completion event queue tasklet is pending to cause a denial of service.

2240) Memory leak (CVE-ID: CVE-2026-92519)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory release in the RISC-V BPF JIT cleanup routine bpf_jit_free() when JIT compilation fails for a later BPF subprogram. A local user can trigger JIT compilation failure for a later BPF subprogram to cause a denial of service.

2241) Use-after-free (CVE-ID: CVE-2026-92521)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger use of freed memory.

The vulnerability exists due to a use-after-free in ACPI PCI root handling when processing hot-add failures or root bridge removal. A local user can invoke a later acpi_pci_find_root() lookup to trigger use of freed memory.

The freed root object remains referenced by device->driver_data.

2242) Out-of-bounds read (CVE-ID: CVE-2026-92522)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to read out-of-bounds memory.

The vulnerability exists due to improper bounds validation in the ACPI IOAPIC hotplug lookup when parsing MADT and _MAT records. A local privileged user can provide a malformed record with a truncated header, an oversized declared length, or an incomplete IOAPIC body to read out-of-bounds memory.

Only builds with CONFIG_ACPI_HOTPLUG_IOAPIC enabled include the affected code.

2243) Out-of-bounds read (CVE-ID: CVE-2026-92523)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds read.

The vulnerability exists due to improper input validation in nldev_stat_set_counter_dynamic_doit when processing nested RDMA_NLDEV_ATTR_STAT_HWCOUNTERS netlink attributes. A local user can provide a nested attribute containing a child payload shorter than a u32 to perform an out-of-bounds read.

2244) Improper resource shutdown or release (CVE-ID: CVE-2026-92524)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource cleanup in its_vpe_irq_domain_alloc() when an interrupt allocation fails. A local user can trigger an allocation failure to cause a denial of service.

2245) Out-of-bounds read (CVE-ID: CVE-2026-92525)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in copy_data() when processing a user-supplied work queue element. A local user can post a work queue element with an out-of-range cur_sge or oversized num_sge to cause a denial of service.

2246) Unchecked Return Value (CVE-ID: CVE-2026-93037)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause improper processing of a request.

The vulnerability exists due to an unchecked return value in the set_txreq_header_ahg() function when initializing an accelerated header generation transmit request. A local user can submit a request for which sdma_txinit_ahg() fails to cause improper processing of a request.

2247) Use-after-free (CVE-ID: CVE-2026-93039)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free and double free.

The vulnerability exists due to a stale pointer after reallocation in meson_card_reallocate_links() when handling failure of the second memory reallocation after the first reallocation moves the DAI link array. A local user can cause the second memory reallocation to fail after the first reallocation moves the DAI link array to trigger a use-after-free and double free.

2248) Race condition (CVE-ID: CVE-2026-93040)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the DesignWare eDMA channel state handling when pause(), resume(), or issue_pending() evaluates channel state concurrently with interrupt handlers. A local user can invoke DMA channel operations during a concurrent state transition to cause a denial of service.

2249) Race condition (CVE-ID: CVE-2026-93041)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the dw-edma abort interrupt handler when aborting a DMA request while queued descriptors are being started. A local user can trigger an abort during the state transition to leave queued descriptors unprocessed and the channel idle.

2250) Use-after-free (CVE-ID: CVE-2026-93042)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to improper descriptor termination in the dw-edma DMA engine driver when terminating DMA transfers. A local user can invoke dmaengine_terminate_sync() during a deferred STOP, allowing a late callback to dereference freed client state to trigger a use-after-free condition.

A pending STOP may remain unresolved until the running transfer generates an interrupt.

2251) Memory corruption (CVE-ID: CVE-2026-93046)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access memory out of bounds.

The vulnerability exists due to improper bounds checking in software_node_get_reference_args() when handling a reference argument index value of UINT_MAX. A local user can provide an index value of UINT_MAX to access memory out of bounds.

2252) Integer underflow (CVE-ID: CVE-2026-93048)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to integer underflow in mtd_add_partition() when processing BLKPG ioctl requests on NAND devices. A local user can pass MTDPART_OFS_RETAIN (-3) as a partition offset to trigger a kernel warning.

Depending on the size calculation, an empty disabled partition can be created.

2253) Double free (CVE-ID: CVE-2026-93049)

CWE-ID: CWE-415 - Double Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in mtdswap_add_mtd() cleanup handling when debugfs setup fails after blktrans device registration. A local user can trigger the debugfs failure sequence to cause a denial of service.

2254) Use-after-free (CVE-ID: CVE-2026-93050)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in ipoctal_cleanup() when tty cleanup occurs after the associated ipack device has been freed. A local user can close an open tty after device removal to cause a denial of service.

2255) NULL pointer dereference (CVE-ID: CVE-2026-93050)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to null pointer dereference in ipoctal_write_tty() when writing to a tty whose transmit buffer has been freed during device removal. A local user can write to an open tty after device removal to cause a denial of service.

2256) Use-after-free (CVE-ID: CVE-2026-93050)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the ipoctal driver struct ipoctal lifetime handling when an IP-OCTAL device is removed while a tty session remains active. A local user can issue tty operations during device removal to cause a denial of service.

2257) Use-after-free (CVE-ID: CVE-2026-93051)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Linux kernel ad525x_dpot driver's sysfs attribute handling when removing a device without removing its command sysfs attributes before freeing driver data. A local user can access command sysfs attributes that remain exposed after the driver data is freed to cause a denial of service.

The command sysfs attributes are exposed only for devices supporting the F_CMD_INC feature.

2258) Race condition (CVE-ID: CVE-2026-93052)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access message queues using stale cached queue information.

The vulnerability exists due to improper synchronization in the bcm-vk message queue initialization and driver access checks when initializing message queues concurrently with driver access. A local user can race message queue initialization with driver access to access message queues using stale cached queue information.

2259) Out-of-bounds write (CVE-ID: CVE-2026-93053)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause an out-of-bounds write.

The vulnerability exists due to improper validation of function-name initial characters in the speakup keyhelp letter_offsets[] handling when processing function names overridden through sysfs. A local privileged user can override a function name with an initial character outside the a-z range to cause an out-of-bounds write.

2260) Use-after-free (CVE-ID: CVE-2026-93054)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the __uio_register_device() UIO registration failure path when an opener races with a failed registration after device_add(). A local user can race opening /dev/uioX with a failed device registration to cause a denial of service.

2261) Out-of-bounds read (CVE-ID: CVE-2026-93055)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in udf_pc_to_char() when processing malformed UDF symlink data containing a partial pathComponent header. A local user can provide malformed UDF symlink data containing a partial pathComponent header to cause an out-of-bounds read.

2262) NULL pointer dereference (CVE-ID: CVE-2026-93056)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the f_uac1_legacy configfs string attribute store handler when writing to the fn_play, fn_cap, or fn_cntl attribute during a memory-allocation failure. A local user can write to an affected configfs attribute while memory allocation fails to cause a denial of service.

2263) Buffer Over-read (CVE-ID: CVE-2026-93061)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in host1x_debug_output() and host1x_debug_cont() when generating debug output longer than 256 bytes. A local user can access affected debugfs output to disclose sensitive information.

Only debugfs files are affected; the printk debug sink ignores the supplied byte count.

2264) Division by zero (CVE-ID: CVE-2026-93062)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to division by zero in iwl_dbg_tlv_alloc_fragments when processing firmware monitor configuration data with a zero required size or fragment count. A local user can trigger processing of such configuration data to cause a denial of service.

2265) Buffer overflow (CVE-ID: CVE-2026-93063)

CWE-ID: CWE-120 - Buffer overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a buffer overflow.

The vulnerability exists due to improper bounds checking in the iwl_mei_handle_sap_rx_cmd function when processing an oversized SAP message. A local user can supply a SAP message whose declared length exceeds the local buffer size to cause a buffer overflow.

2266) Off-by-one (CVE-ID: CVE-2026-93064)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an off-by-one error in iwl_mvm_frob_txf_key_iter() when sanitizing TXF keys. A local user can trigger sanitization of a fully matched key to cause memory corruption.

2267) Integer overflow (CVE-ID: CVE-2026-93065)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in iwl_fwrt_dump_error_logs when processing firmware that advertises more than 255 PC entries. A local user can trigger processing of firmware advertising more than 255 PC entries to cause a denial of service.

2268) Stack-based buffer overflow (CVE-ID: CVE-2026-93067)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a stack-based buffer overflow.

The vulnerability exists due to improper validation of controller-reported AUX byte counts in tc_aux_transfer() and tc_aux_read_data() when handling AUX read transfers. A local user can trigger processing of an AUX read response that reports a byte count larger than requested to cause a stack-based buffer overflow.

The controller-reported byte count can be as high as 255 despite the 16-byte auxrdata stack buffer.

2269) Use-after-free (CVE-ID: CVE-2026-93072)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to use-after-free in the Renesas IRQC interrupt controller driver when the driver is removed and generic interrupt chip callbacks are subsequently invoked. A local privileged user can remove the driver and trigger a generic interrupt chip callback to cause a denial of service.

2270) Race condition (CVE-ID: CVE-2026-93073)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in dax_holder_notify_failure() when fs_put_dax() concurrently clears holder_ops. A local user can trigger the race to dereference a null holder_ops pointer.

2271) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-93083)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to missing release of a resource after its effective lifetime in mailbox_chan_setup() when requesting an additional unidirectional TX receiver mailbox channel. A local user can initiate mailbox channel setup to cause a denial of service.

The primary mailbox channel remains busy for later probe attempts if the additional channel request fails.

2272) Memory leak (CVE-ID: CVE-2026-93084)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak SCMI instance user references.

The vulnerability exists due to improper resource cleanup in the SCMI bus notifier when a protocol driver probe fails after an SCMI handle has been acquired. A local user can trigger a failed protocol-device bind to leak SCMI instance user references.

If a device dependency link cannot be created, a concurrent parent unbind can tear down the SCMI instance while the child retains a handle.

2273) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-93085)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause SCMI protocol ID truncation or aliasing.

The vulnerability exists due to improper validation of specified quantities in input in the SCMI device tree parsing paths when processing a malformed 32-bit device tree reg value. A local user can provide an out-of-range protocol ID to cause SCMI protocol ID truncation or aliasing.

2274) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-93086)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource lifecycle management in the SCMI channel cleanup routine when cleaning TX/RX channels. A local user can initiate SCMI channel cleanup to cause a denial of service.

2275) Improper resource shutdown or release (CVE-ID: CVE-2026-93089)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause resource leaks.

The vulnerability exists due to improper resource shutdown or release in the SCMI transport channel setup error-handling path when an IDR insertion fails after transport channel setup succeeds. A local privileged user can initiate transport channel setup to cause resource leaks.

2276) Incomplete cleanup (CVE-ID: CVE-2026-93090)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a resource leak.

The vulnerability exists due to incomplete cleanup in the SCMI channel setup error-handling path when SCMI channel setup fails. A local user can cause SCMI channel setup to fail to cause a resource leak.

2277) Race condition (CVE-ID: CVE-2026-93092)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a race condition in the SCMI driver.

The vulnerability exists due to improper synchronization in requested-devices notifier handling when a SCMI device is being removed. A local user can cause a requested-devices notifier callback to race with active_protocols IDR teardown to cause a race condition in the SCMI driver.

2278) NULL pointer dereference (CVE-ID: CVE-2026-93093)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the ARM SCMI mailbox and SMC transport setup routines when a pending or spurious callback occurs before channel state is fully initialized. A local user can trigger an early transport callback to cause a denial of service.

2279) Out-of-bounds write (CVE-ID: CVE-2026-93095)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds write.

The vulnerability exists due to improper validation of catalog thread records in hfsplus_delete_cat() when rebuilding a catalog key from a corrupted HFS+ image. A local user can supply a corrupted HFS+ image with an oversized thread name length to cause an out-of-bounds write.

2280) Infinite loop (CVE-ID: CVE-2026-93097)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to an infinite loop in the CXL poison list processing function when processing a device response containing an empty poison payload with the CXL_POISON_FLAG_MORE flag set. An attacker with physical access can cause a CXL device to return a crafted poison response to cause a denial of service.

2281) Deadlock (CVE-ID: CVE-2026-93098)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a deadlock in GLINK endpoint destruction when detaching an rpmsg driver. A local privileged user can trigger driver detachment to cause a denial of service.

2282) Improper resource shutdown or release (CVE-ID: CVE-2026-93101)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in v4l2_async_unregister_subdev() when disconnecting a susceptible em28xx USB device. An attacker with physical access can disconnect the USB device to cause a denial of service.

The issue occurs when a tvp5150 I2C sub-device is registered through means other than v4l2-async and its asynchronous connection list is empty.

2283) Memory leak (CVE-ID: CVE-2026-93102)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource cleanup in the hfi1 init_one() cleanup path when hfi1_init() or hfi1_register_ib_device() fails after RX support allocation. A local user can trigger a late probe failure to cause a denial of service.

2284) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-93103)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of an allocation failure in hfi1_free_devdata() when allocating a unit ID for an HFI1 device. A local user can cause unit ID allocation to fail to cause a denial of service.

The issue occurs when cleanup runs before the device has been inserted into the unit table.

2285) Improper update of reference count (CVE-ID: CVE-2026-93105)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to free a page that is still in use.

The vulnerability exists due to improper reference count handling in the ESP esp_ssg_unref() function when processing an ESP packet with managed fragments during an AEAD operation. A local user can process an ESP packet with managed fragments to free a page that is still in use.

Managed fragments can be attached through io_uring SEND_ZC with a registered buffer.

2286) Race condition (CVE-ID: CVE-2026-93107)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and corrupt data.

The vulnerability exists due to a race condition in the RDMA RXE responder state machine's do_complete function when a queue pair enters the error state while completing a received packet. A remote attacker can send a packet while a disconnect races with receive processing to cause a denial of service and corrupt data.

2287) Race condition (CVE-ID: CVE-2026-93108)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper synchronization in the IPoIB module teardown path when unloading the module while RCU callbacks remain pending. A local privileged user can initiate module teardown before queued RCU callbacks complete to cause a denial of service.

The condition can also occur after client registration failure removes already-added devices and queues callbacks.

2288) Use-after-free (CVE-ID: CVE-2026-93109)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a failure to wait for queued RCU callbacks in mlx5_ib module teardown when closing a DevX event file or detaching auxiliary driver devices. A local user can close a DevX event file to cause a denial of service.

The issue can also occur during registration error unwinding after driver registration attaches existing devices before failing.

2289) Use-after-free (CVE-ID: CVE-2026-93110)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a use-after-free condition in the RDMA core ib_core cleanup routine when unloading the ib_core module after RCU callbacks have been queued. A local privileged user can cause queued callbacks to invoke unloaded module code to cause a denial of service.

Exploitation requires RCU callbacks queued by put_gid_ndev() before module unloading.

2290) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-93113)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to improper clock registration in CAMCC_GDSC_CLK in the Qualcomm SC8280XP camera clock controller when unused clocks are shut down. A local user can trigger unused-clock shutdown to trigger a kernel warning.

2291) NULL pointer dereference (CVE-ID: CVE-2026-93114)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in san_probe when the Surface ACPI notification driver is force-bound to a device without an ACPI companion. A local user can force-bind the driver to such a device to cause a denial of service.

2292) NULL pointer dereference (CVE-ID: CVE-2026-93115)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the mlxbf_pmc_probe() function of the mlxbf-pmc driver when force-binding the driver to a device without an ACPI companion object. A local user can force-bind the driver to such a device to cause a denial of service.

2293) Use-after-free (CVE-ID: CVE-2026-93117)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to a use-after-free in usb_probe_interface when a USB driver probe runs concurrently with dynamic ID removal. A local user can trigger concurrent USB driver probing and dynamic ID removal to trigger a use-after-free condition.

2294) NULL pointer dereference (CVE-ID: CVE-2026-93118)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an unchecked allocator return in the Aspeed UDC driver's ast_udc_probe() function when initializing endpoint buffers after coherent DMA buffer allocation fails. A local privileged user can cause the driver to dereference a null endpoint buffer during probe to cause a denial of service.

2295) Stack-based buffer overflow (CVE-ID: CVE-2026-93119)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 0 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a stack-based buffer overflow.

The vulnerability exists due to a stack-based buffer overflow in the valid_pin array in ljca_enumerate_gpio() when processing device-provided GPIO descriptors. An attacker with physical access can report a bank_num value exceeding the valid_pin array capacity to cause a stack-based buffer overflow.

2296) Out-of-bounds read (CVE-ID: CVE-2026-93120)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in os_desc_qw_sign_show() in the USB gadget configfs implementation when converting a stored signature from UTF-16 to UTF-8. A local user can store a signature that fills the buffer without a NUL terminator and read the configfs attribute to disclose sensitive information.

2297) Memory leak (CVE-ID: CVE-2026-93126)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak device node references.

The vulnerability exists due to a missing release of a device node reference in the adsp_map_carveout function when calling of_parse_phandle_with_args(). A local user can cause the function to process a device-tree phandle to leak device node references.

2298) Improper resource shutdown or release (CVE-ID: CVE-2026-93130)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a resource leak.

The vulnerability exists due to improper resource shutdown or release in the dell-wmi-base module initialization routine when module initialization fails. A local privileged user can trigger a module load failure to cause a resource leak.

2299) Use-after-free (CVE-ID: CVE-2026-93131)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access freed memory.

The vulnerability exists due to a use-after-free race condition in the Dell privacy WMI driver when accessing the features_present field without holding the list mutex. A local user can trigger concurrent access to the field while the associated privacy data is freed to access freed memory.

2300) Memory leak (CVE-ID: CVE-2026-93136)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a resource leak.

The vulnerability exists due to improper reference count management in mhi_ep_create_device() when dev_set_name() or device_add() fails during MHI device creation. A local user can trigger a device-creation error to cause a resource leak.

2301) Use-after-free (CVE-ID: CVE-2026-93137)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in bpf_find_vma() when a BPF program accesses virtual memory area information for a foreign task. A local user can invoke bpf_find_vma() with a foreign task to trigger a use-after-free condition.

The foreign task must exit concurrently.

2302) Race condition (CVE-ID: CVE-2026-93138)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access incompletely initialized vmlinux BTF data.

The vulnerability exists due to a race condition in bpf_get_btf_vmlinux when concurrently invoking the function during first-time vmlinux BTF parsing. A local user can invoke the affected function concurrently to access incompletely initialized vmlinux BTF data.

The race can occur on weakly ordered architectures when CONFIG_DEBUG_INFO_BTF is enabled.

2303) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-93140)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a spurious kernel warning.

The vulnerability exists due to improper handling of an exceptional I/O condition in the UDF Logical Volume Integrity Descriptor buffer when marking the buffer dirty after a write I/O error. A local user can remount the filesystem read-write or synchronize it to trigger a spurious kernel warning.

2304) Double free (CVE-ID: CVE-2026-93141)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in r8a66597_probe() when usb_add_gadget_udc() fails. A local user can trigger the probe error path to cause a denial of service.

2305) Unchecked Return Value (CVE-ID: CVE-2026-93142)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in the rcar_thermal_probe() function when registering a thermal zone during driver probe. A local user can trigger a thermal zone registration failure to cause a denial of service.

2306) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-93145)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to failure to release generic power-domain structures in gdsc_unregister() when performing a provider unbind and rebind cycle. A local privileged user can trigger a provider unbind and rebind cycle to cause a denial of service.

2307) Race condition (CVE-ID: CVE-2026-93149)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the mac80211_hwsim_stop() pending-frame queue drain when stopping the mac80211_hwsim device. A local user can trigger concurrent TX status handling that removes the final pending frame to cause a denial of service.

2308) Race condition (CVE-ID: CVE-2026-93150)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect operations.

The vulnerability exists due to a race condition in the cpuset subsystem's nr_deadline_tasks counter when concurrent scheduler-policy changes and cpuset attachment operations update the counter. A local user can perform concurrent scheduler-policy and cpuset attachment operations to cause incorrect operations.

2309) Memory leak (CVE-ID: CVE-2026-93151)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a memory leak.

The vulnerability exists due to failure to release response resources in the nvmet-rdma queue teardown routine when an RDMA connection is forcefully disconnected while I/O operations are in flight. A remote attacker can disconnect an RDMA connection while I/O operations are in flight to cause a memory leak.

2310) Race condition (CVE-ID: CVE-2026-93152)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access queue state before its initialization is visible.

The vulnerability exists due to improper synchronization in the Apple NVMe driver's queue enabled-state handling when interrupt or request paths check whether a queue is enabled. A local user can race queue-state checks with queue initialization to access queue state before its initialization is visible.

2311) Out-of-bounds read (CVE-ID: CVE-2026-93155)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in the Keem Bay OCS AES driver's register_aes_algs() function when skcipher algorithm registration fails after AEAD algorithm registration. A local privileged user can trigger the registration error path to cause a denial of service.

2312) Unchecked Return Value (CVE-ID: CVE-2026-93156)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause hash requests to produce incorrect digest values.

The vulnerability exists due to an unchecked return value in the rk3288 crypto ahash driver's rk_hash_run() function when waiting for the hash engine to become idle after a final DMA transfer. A local user can submit a hash request while the hash engine does not become idle to cause hash requests to produce incorrect digest values.

2313) Unchecked Return Value (CVE-ID: CVE-2026-93158)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause crypto request setup failures.

The vulnerability exists due to unchecked return value handling in sa_ul_probe() when security-context DMA pool creation fails. A local user can initiate use of the driver after DMA pool creation fails to cause crypto request setup failures.

2314) Incomplete cleanup (CVE-ID: CVE-2026-93159)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to incomplete cleanup in the atmel-sha204a nonblocking RNG path when an asynchronous I2C transfer fails. A local user can make subsequent read attempts after a failed I2C transfer to disclose sensitive information.

2315) Key management errors (CVE-ID: CVE-2026-93160)

CWE-ID: CWE-320 - Key Management Errors

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to derive a shared secret using a private key not generated for the current transform context.

The vulnerability exists due to improper cryptographic key management in atmel_ecdh_compute_shared_secret() when processing hardware ECDH shared-secret requests without a cached public key. A local user can submit a hardware ECDH shared-secret request without a cached public key to derive a shared secret using a private key not generated for the current transform context.

2316) Sensitive Information in Resource Not Removed Before Reuse (CVE-ID: CVE-2026-93161)

CWE-ID: CWE-226 - Sensitive Information in Resource Not Removed Before Reuse

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive key material.

The vulnerability exists due to failure to clear sensitive information from stack memory in qat_alg_xts_reverse_key() when expanding a forward XTS AES key. A local user can access residual AES key material in stack memory to disclose sensitive key material.

2317) Expired pointer dereference (CVE-ID: CVE-2026-93162)

CWE-ID: CWE-825 - Expired pointer dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an expired pointer dereference in the QAT reset worker when an SR-IOV reenable completion wait times out. A local user can trigger a QAT device reset that reaches the timeout to cause memory corruption.

2318) Use-after-free (CVE-ID: CVE-2026-93163)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to a use-after-free in the hwrng_register function when handling a hardware random number generator registration failure. A local user can cause registration to fail after the random number generator has been added to the global rng_list and free the associated structure to trigger a use-after-free.

2319) Out-of-bounds read (CVE-ID: CVE-2026-93165)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to overread memory.

The vulnerability exists due to an out-of-bounds read in cros_ec_sensorhub_ring_handler() when processing FIFO information responses from EC firmware. A local privileged user can cause the handler to process a response whose length is shorter than expected to overread memory.

The condition can occur when EC firmware reports inconsistent maximum response and sensor-count values.

2320) Use of Out-of-range Pointer Offset (CVE-ID: CVE-2026-93167)

CWE-ID: CWE-823 - Use of Out-of-range Pointer Offset

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect stack offset handling in the C-SKY syscall trace path when tracing system calls with fifth or sixth arguments. A local user can trace a process executing a system call with five or six arguments to cause a denial of service.

The issue is limited to the C-SKY ABIv2 syscall trace path.

2321) Race condition (CVE-ID: CVE-2026-93170)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause descriptor corruption or missed DMA completions.

The vulnerability exists due to a race condition in the Xilinx AXIDMA and MCDMA interrupt handlers when handling descriptor-completion interrupts. A local user can queue multiple active descriptors before a completion interrupt occurs to cause descriptor corruption or missed DMA completions.

Exploitation requires descriptors to remain in the active list after completed descriptors are moved to the done list.

2322) NULL pointer dereference (CVE-ID: CVE-2026-93172)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in free_area_init_core_hotplug when initializing per-CPU node statistics during memory hotplug. A local privileged user can initiate a memory hotplug operation that encounters a failed per_cpu_nodestats allocation to cause a denial of service.

2323) Use of uninitialized resource (CVE-ID: CVE-2026-93174)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose stale heap contents.

The vulnerability exists due to incomplete copying of per-CPU map value padding in copy_map_value_long() when processing UAPI LOOKUP_ELEM operations on per-CPU maps. A local user can invoke a UAPI lookup operation on a per-CPU map with a value size that requires padding to disclose stale heap contents.

The issue also affects bpf_iter for per-CPU maps.

2324) Out-of-bounds read (CVE-ID: CVE-2026-93177)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in the Vega10 PowerPlay hardware manager when parsing VBIOS-provided voltage dependency tables. A local user can provide voltage table entries containing out-of-range lookup indices to read out-of-bounds memory.

2325) Out-of-bounds read (CVE-ID: CVE-2026-93178)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in the SMU7 powerplay voltage lookup handling when processing VBIOS-parsed voltage table entries containing out-of-range voltage indices. A local user can provide VBIOS-parsed table entries with out-of-range voltage indices to perform an out-of-bounds read.

2326) Out-of-bounds read (CVE-ID: CVE-2026-93179)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or trigger an out-of-bounds read.

The vulnerability exists due to improper validation of voltage-object sizes in the AMD PowerPlay VoltageObjectInfo table lookup routines when processing a malformed VBIOS VoltageObjectInfo table. A local user can cause the driver to process a malformed VoltageObjectInfo table to cause a denial of service or trigger an out-of-bounds read.

2327) Integer overflow (CVE-ID: CVE-2026-93182)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in update_tg_cfs_runnable() in the fair scheduler when processing scheduler runnable-load updates. A local user can run a hackbench workload to cause a denial of service.

2328) Improper initialization (CVE-ID: CVE-2026-93183)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization order in lima_device_init() when initializing the Lima device. A local user can trigger creation of an empty Lima VM before its allocation range is configured to cause a denial of service.

The kernel BUG condition is triggered when DRM_DEBUG_MM is enabled.

2329) Improper initialization (CVE-ID: CVE-2026-93184)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a system hang.

The vulnerability exists due to improper runtime power management handling in the fsl_audmix probe routine when accessing ALSA control or DAPM paths before the first runtime resume. A local user can access an affected audio control path to cause a system hang.

2330) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-93185)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause active timer or work objects to remain after device removal.

The vulnerability exists due to improper cancellation of delayed work in rt700_sdw_remove() when removing an RT700 SoundWire codec after the SoundWire slave becomes unattached while jack work is pending. A local privileged user can cause the remove path to skip cancellation of pending jack work.

Practical reachability depends on SoundWire core remove ordering after an unattached status update.

2331) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-93186)

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uncontrolled memory allocation in the CXL mailbox command constructor cxl_mbox_cmd_ctor() when processing CXL_MEM_SEND_COMMAND requests with an oversized output size. A local user can submit a command with a large output size to cause a denial of service.

A system panic requires panic_on_warn=1.

2332) Out-of-bounds read (CVE-ID: CVE-2026-93188)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose out-of-bounds data.

The vulnerability exists due to an out-of-bounds read in the Roccat Kone HID driver's profile handling when processing a device-supplied profile index. An attacker with physical access can connect a malicious USB device claiming the Roccat Kone ID and send a switch-profile event or provide a startup profile value during probing to disclose out-of-bounds data.

The out-of-bounds read result is exposed through the actual_dpi sysfs attribute.

2333) Use-after-free (CVE-ID: CVE-2026-93189)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to failure to quiesce HID input before freeing objects in hid_hw_stop() in the HID core when a driver probe unwinds after HID input has been enabled while HID reports are in flight. A local user can trigger a failed driver initialization while HID reports are being processed to trigger a use-after-free condition.

2334) Stack-based buffer overflow (CVE-ID: CVE-2026-93190)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause memory corruption.

The vulnerability exists due to a stack-based buffer overflow in cros_typec_register_partner_pdos() when processing EC TYPEC_STATUS responses with a source or sink PDO count exceeding PDO_MAX_OBJECTS. A local privileged user can provide a response with an oversized PDO count to cause memory corruption.

2335) Incorrect authorization (CVE-ID: CVE-2026-93191)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose messages to an unauthorized receiver.

The vulnerability exists due to improper authorization in smack_msg_queue_msgrcv when processing messages through the pipelined_send optimization for a waiting receiver. A local user can send a message to a queue while an unauthorized target task is waiting to receive it to disclose messages to an unauthorized receiver.

2336) Use-after-free (CVE-ID: CVE-2026-93192)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise system confidentiality, integrity, and availability.

The vulnerability exists due to failure to clear a dangling active-job pointer in the Linux kernel V3D driver's BIN, RENDER, TFU, and CSD job execution callbacks when v3d_fence_create() fails during job execution. A local user can exploit the stale queue->active_job reference to compromise system confidentiality, integrity, and availability.

The BIN queue's active-job reference can also be accessed concurrently by v3d_overflow_mem_work().

2337) Use-after-free (CVE-ID: CVE-2026-93196)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in virtio_pmem_host_ack() when completing a virtio pmem flush request after virtio_pmem_flush() has freed its request token. A local user can trigger this race to cause a denial of service.

2338) Incorrect Comparison (CVE-ID: CVE-2026-93199)

CWE-ID: CWE-697 - Incorrect Comparison

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect duplicate-device detection.

The vulnerability exists due to an incorrect comparison in i3c_master_search_i3c_dev_duplicate() when searching I3C devices with matching PIDs. A local user can cause the controller device to be identified as a duplicate target device.

2339) Use-after-free (CVE-ID: CVE-2026-93200)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to a use-after-free in master->this handling in the I3C master controller when accessing sysfs attributes for the master controller device. A local user can access sysfs attributes for the master controller device to trigger a use-after-free.

2340) Race condition (CVE-ID: CVE-2026-93203)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt backbone gateway CRC values.

The vulnerability exists due to a race condition in batadv_bla_add_claim() when processing concurrent CLAIM frames for the same client. A remote attacker can send concurrent CLAIM frames to corrupt backbone gateway CRC values.

2341) Race condition (CVE-ID: CVE-2026-93204)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2.3 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to poison an ARP cache.

The vulnerability exists due to a race condition caused by non-atomic MAC address updates in batadv_dat_entry_add() in the batman-adv distributed ARP table when a MAC address is updated concurrently with a reader accessing the entry. A remote attacker can cause a MAC address update to race with a reader to poison an ARP cache.

2342) Use-after-free (CVE-ID: CVE-2026-93205)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a use-after-free in the IOPF queue cleanup performed by arm_smmu_device_remove() when removing an Arm SMMU device. A local privileged user can trigger device removal while the event-queue IRQ handler accesses the IOPF queue to cause a denial of service.

2343) Incorrect authorization (CVE-ID: CVE-2026-93206)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disclose PCI configuration-space information.

The vulnerability exists due to improper authorization using the credentials of the calling task rather than the opening process in proc_bus_pci_read() when reading PCI configuration space through procfs. A local privileged user can pass a file descriptor opened with CAP_SYS_ADMIN to an unprivileged process to disclose PCI configuration-space information.

2344) Use-after-free (CVE-ID: CVE-2026-93207)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to access freed memory.

The vulnerability exists due to a use-after-free condition in svcauth_gss_decode_credbody() when processing malformed RPC GSS credential bodies. A remote attacker can send a malformed RPC GSS credential to access freed memory.

The credential storage is reused across requests, allowing a dangling context-data pointer to be paired with a stale length after request pages are released.

2345) Race condition (CVE-ID: CVE-2026-93208)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to prevent slab caches from being released.

The vulnerability exists due to a race condition in KASAN quarantine cache removal when a CPU goes offline after per-CPU cache processing. A local user can trigger cache shrinking or destruction during CPU hotplug activity to prevent slab caches from being released.

Only kernels built with CONFIG_KASAN_GENERIC are affected.

2346) Unchecked Return Value (CVE-ID: CVE-2026-93209)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause Bluetooth enable operations to time out.

The vulnerability exists due to improper handling of an allocation failure in the Bluetooth HCI command synchronization functionality when processing a Bluetooth command under memory pressure. A local user can trigger Bluetooth command processing during memory pressure to cause Bluetooth enable operations to time out.

2347) NULL pointer dereference (CVE-ID: CVE-2026-93210)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the SMB client DFS cache when processing an invalid target hint. A local user can cause the DFS cache to process an invalid target hint to cause a denial of service.

2348) Race condition (CVE-ID: CVE-2026-93211)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in DRC hash table initialization in nfsd_reply_cache_init when the DRC shrinker scans the reply cache before bucket list heads are initialized. A local user can trigger reply-cache initialization concurrently with a shrinker scan to cause a denial of service.

The issue occurs on weakly ordered architectures such as arm64 and ppc.

2349) Out-of-bounds read (CVE-ID: CVE-2026-93213)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in the of_alias_scan() stem parser when parsing a property name that is empty or consists only of digits. A local user can trigger parsing of such a property name to perform an out-of-bounds read.

2350) Deadlock (CVE-ID: CVE-2026-93214)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock ordering in usbg_make_tpg() when performing configfs dependency operations across subsystems. A local user can trigger concurrent configfs operations to cause a denial of service.

Exploitation requires a circular lock dependency involving configfs_rmdir().

2351) Double free (CVE-ID: CVE-2026-93215)

CWE-ID: CWE-415 - Double Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in cdx_create_res_attr() when sysfs binary file creation fails. A local user can trigger resource attribute creation under this failure condition to cause a denial of service.

2352) Incorrect calculation (CVE-ID: CVE-2026-93219)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an incorrect minimum interval calculation in the sun4i clockevent timer driver when processing timer events. A local user can trigger timer events to cause a denial of service.

The issue can leave the next timer event stuck during oneshot, high-resolution, or nohz timer operation.

2353) Exposure of Resource to Wrong Sphere (CVE-ID: CVE-2026-93222)

CWE-ID: CWE-668 - Exposure of resource to wrong sphere

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause signal sender identifiers to be incorrectly rewritten.

The vulnerability exists due to improper handling of shared siginfo data in the signal delivery logic when delivering group signals across namespaces. A local user can send a group signal to cause sender identifiers rewritten for one recipient to affect subsequent recipients.

2354) Improper update of reference count (CVE-ID: CVE-2026-93223)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a reference count underflow of an Open Firmware node.

The vulnerability exists due to improper reference count management in tegra_vip_channel_of_parse() in the tegra-video VIP driver when parsing endpoint nodes from a malformed device tree. A local user can trigger an endpoint parsing error with a malformed device tree to cause a reference count underflow of an Open Firmware node.

2355) Race condition (CVE-ID: CVE-2026-93226)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a race condition.

The vulnerability exists due to an unsafe iteration of an RCU-protected list in rt6_nh_dump_exceptions() when dumping IPv6 route exceptions while exception entries are concurrently added. A local user can initiate an IPv6 route dump during concurrent route exception insertion to trigger a race condition.

2356) Improper input validation (CVE-ID: CVE-2026-93228)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause improper processing of malformed RPC-over-RDMA chunks.

The vulnerability exists due to improper input validation in the xdr_check_write_chunk() function when processing Write or Reply chunks with a zero segment count. A remote attacker can send a malformed Write or Reply chunk with a zero segment count to cause improper processing of malformed RPC-over-RDMA chunks.

2357) Race condition (CVE-ID: CVE-2026-93229)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to obtain inconsistent RPC request status information.

The vulnerability exists due to a missing read memory barrier in nfsd_nl_rpc_status_get_dumpit() when reporting RPC request status through a dump operation. A local user can request RPC status information during concurrent request-status updates to obtain inconsistent RPC request status information.

The issue occurs on weakly ordered architectures such as ARM and POWER.

2358) Function Call with Incorrectly Specified Arguments (CVE-ID: CVE-2026-93231)

CWE-ID: CWE-628 - Function Call with Incorrectly Specified Arguments

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to prevent locks associated with a requested server IP address from being released.

The vulnerability exists due to incorrectly specified arguments in nlmsvc_match_ip() when releasing locks by server IP address through /proc/fs/nfsd/unlock_ip. A local user can invoke the unlock-by-IP operation to prevent locks associated with the requested server IP address from being released.

2359) Out-of-bounds read (CVE-ID: CVE-2026-93234)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to perform an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in gud_connector_add_tv_mode() when processing TV mode names returned by a GUD device. An attacker with physical access can provide a device response containing a TV mode name without a NUL terminator to perform an out-of-bounds read.

2360) Improper initialization (CVE-ID: CVE-2026-93235)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper initialization of post-EOF data in the F2FS file size extension handling when extending a file across an unaligned EOF boundary. A local user can extend a file across an unaligned EOF boundary to disclose sensitive information.

Stale disk data can be exposed after remounting or crash recovery when metadata is persisted before the zeroed data.

2361) NULL pointer dereference (CVE-ID: CVE-2026-93236)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in vdec_try_fmt_common() when processing a VIDIOC_TRY_FMT request with an unsupported pixel format on the OUTPUT queue. A local user can submit a crafted VIDIOC_TRY_FMT request to cause a denial of service.

The issue occurs when MPEG2 support has been locally removed and is absent from the platform format table.

2362) Use of Uninitialized Variable (CVE-ID: CVE-2026-93238)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause unintended guest hardware queue resets.

The vulnerability exists due to use of an uninitialized bitmap in vfio_ap_mdev_hot_plug_cfg() when processing a hot-plug configuration change that adds only control domains. A local user can modify the hot-plug configuration to add only control domains to cause unintended guest hardware queue resets.

2363) Use-after-free (CVE-ID: CVE-2026-93239)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a kernel fault.

The vulnerability exists due to use-after-free in the arm64 show_pte() page-table walk when walking task page tables concurrently with teardown. A local user can cause a task page-table teardown to occur during the walk to cause a kernel fault.

The walk can also derive a lower-level pointer from a parent entry that has been cleared concurrently.

2364) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-93240)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to improper execution-context handling in the cgroup v1 memory soft limit reclaim path when soft limit reclaim invokes lru_gen_shrink_lruvec() from kswapd. A local user can configure memory.soft_limit_in_bytes to trigger a kernel warning.

2365) Off-by-one (CVE-ID: CVE-2026-93242)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause legitimate firmware responses to be dropped.

The vulnerability exists due to an off-by-one error in __qla_consume_iocb() in the qla2xxx response queue handler when processing response queue IOCBs. A local user can trigger response queue processing to consume an unrelated IOCB and cause legitimate firmware responses to be dropped.

2366) Resource exhaustion (CVE-ID: CVE-2026-93243)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locked-page resource accounting in the Linux kernel secretmem feature when mapping and unmapping secret memory ranges. A local user can repeatedly map and unmap secret memory ranges to consume all available system memory with unevictable folios and cause a denial of service.

A secretmem file descriptor can be passed between processes and inherited across fork.

2367) Incorrect Conversion between Numeric Types (CVE-ID: CVE-2026-93244)

CWE-ID: CWE-681 - Incorrect Conversion between Numeric Types

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an integer truncation.

The vulnerability exists due to improper range validation in simpledrm device creation when calculating a framebuffer stride. A local user can cause a computed stride exceeding INT_MAX to be assigned to stride to trigger an integer truncation.

2368) Improper initialization (CVE-ID: CVE-2026-93245)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to improper initialization of list heads in AppArmor policy initialization when handling a profile creation failure before initialization completes. A local user can attempt to load a profile that fails during creation to trigger a kernel warning.

2369) Race condition (CVE-ID: CVE-2026-93247)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in Bluetooth management discovery state handling when concurrently updating and reading the UUID discovery filter state. A local user can initiate concurrent Bluetooth service discovery operations to cause a denial of service.

2370) Use-after-free (CVE-ID: CVE-2026-93250)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to a use-after-free in vxlan_mdb_flush() when flushing VXLAN multicast database entries through RTM_DELMDB bulk requests. A local user can create an (S, G) entry before a (*, G) entry and issue a bulk RTM_DELMDB request to cause memory corruption.

The (*, G) entry must be added with NLM_F_REPLACE because adding the source otherwise fails with -EEXIST.

2371) Deadlock (CVE-ID: CVE-2026-93252)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock ordering in the OCFS2 ACL initialization and extended attribute handling paths when concurrently performing extended attribute updates and filesystem node-creation operations. A local user can perform concurrent extended attribute updates and mkdir or mknod operations to cause a denial of service.

Exploitation depends on a pending writer on the journal transaction barrier causing the conflicting lock acquisition paths to block.

2372) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-93256)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper exception masking in the arm64 hibernation resume code when resuming from hibernation. A local privileged user can resume a hibernated system while exceptions are unmasked to cause a denial of service.

Pseudo-NMI support can permit pseudo-NMI exceptions during the resume process.

2373) Reliance on undefined behavior (CVE-ID: CVE-2026-93259)

CWE-ID: CWE-758 - Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an incorrect inline assembly clobber list in the powerpc interrupt-handling functions call_do_irq() and call_do_softirq() when executing the affected stack-switching calls in CONFIG_PPC_KERNEL_PCREL mode. A local user can trigger the affected interrupt-handling paths to cause a denial of service.

Newer GCC versions can allocate values spanning the calls to r2, exposing register corruption when the called functions modify that register.

2374) NULL pointer dereference (CVE-ID: CVE-2026-93261)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a missing null check in __lock_set_class() when register_lock_class() returns NULL. A local user can cause lock class registration to fail to cause a denial of service.

Lock class registration can fail when the lock class pool is exhausted, graph_lock() fails, or key validation fails.

2375) Use-after-free (CVE-ID: CVE-2026-93262)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in ppl_do_flush() when processing RAID5 PPL flushes. A local user can cause ppl_io_unit_finished() to free the io object while the loop continues accessing io->pending_flushes to trigger a use-after-free condition.

2376) Out-of-bounds read (CVE-ID: CVE-2026-93264)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory registration to be rejected.

The vulnerability exists due to an incorrect chunk length calculation in the EFA RDMA driver's pbl_chunk_list_create function when registering a memory region whose PBL page count is a multiple of 510. A local user can register such a memory region to cause memory registration to be rejected.

The issue can also result in an out-of-bounds access to the chunks array.

2377) Improper locking (CVE-ID: CVE-2026-93268)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper lock management in ext4_try_to_expand_extra_isize() when expanding inode extra isize during filesystem mount. A local privileged user can trigger orphan processing during mount to cause a denial of service.

The circular lock dependency involves s_writepages_rwsem, an active jbd2 handle, and xattr_sem.

2378) Deadlock (CVE-ID: CVE-2026-93269)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock ordering in ext4_ext_migrate when invoking the ext4 extent migration ioctl. A local user can trigger concurrent inode eviction and writeback operations to cause a denial of service.

2379) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-93271)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper range validation in ath11k_dp_rx_h_rate() when processing HT, VHT, or HE frames with a reported MCS above the corresponding mac80211 rate-space maximum. A remote attacker can send a wireless frame with an out-of-range reported MCS value to cause a denial of service.

The affected frame decodes correctly despite its reported MCS value exceeding the corresponding mac80211 rate space.

2380) NULL pointer dereference (CVE-ID: CVE-2026-93273)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a missing null check and improper resource release in the tps6594_regulator_probe() multiphase configuration loop when processing multiphase regulator configuration. A local user can trigger the loop with a missing buck device node to cause a denial of service.

2381) NULL pointer dereference (CVE-ID: CVE-2026-93274)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in bcm2835_pinctrl_probe() when handling a failed pin controller registration. A local user can trigger a failed pin controller registration to cause a denial of service.

2382) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-93275)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to improper resource lifecycle management in the Intel PT perf event stop and start callbacks when group throttling invokes callbacks without update flags. A local user can cause an Intel PT event to be throttled to trigger a kernel warning.

The issue can occur when AUX area sampling is used.

2383) Out-of-bounds read (CVE-ID: CVE-2026-93280)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in the Greybus audio topology parser when parsing a topology blob supplied by a connected module. An attacker with physical access can supply a topology blob with section sizes exceeding the fetched size to read out-of-bounds memory.

2384) Out-of-bounds read (CVE-ID: CVE-2026-93281)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in rtw89_mac_check_he_obss_narrow_bw_ru_iter() when processing extended capability information with a length of 10 bytes. A remote attacker can provide an extended capability element that is 10 bytes long to read out-of-bounds memory.

2385) Use-after-free (CVE-ID: CVE-2026-93283)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in i3c_master_register_new_i3c_devs() when handling a device_register() failure. A local user can trigger a device registration failure followed by device unregistration to cause a denial of service.

2386) Race condition (CVE-ID: CVE-2026-93285)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the f2fs garbage-collection thread lifetime management when processing sysfs updates concurrently with filesystem remount or shutdown operations. A local user can update sysfs attributes while the garbage-collection thread is being stopped to cause a denial of service.

Exploitation requires write access to the relevant f2fs sysfs attributes.

2387) NULL pointer dereference (CVE-ID: CVE-2026-93286)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a missing null pointer check in aarp_send_ddp() when sending AppleTalk packets through the LocalTalk fast path on a device without an AppleTalk interface configured. A local user can send an AppleTalk packet to cause a denial of service.

2388) Memory corruption (CVE-ID: CVE-2026-93287)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper bounds checking in the i2c-stub driver's stub_xfer function when processing caller-supplied I2C_SMBUS_I2C_BLOCK_DATA transfers. A local user can issue a crafted SMBus block transfer with an oversized length to cause a denial of service.

2389) Out-of-bounds read (CVE-ID: CVE-2026-93287)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read memory out of bounds.

The vulnerability exists due to an out-of-bounds read in the smbus_write tracepoint when processing caller-supplied oversized SMBus block writes. A local user can issue an SMBus block write with an oversized length to read memory out of bounds.

2390) Use-after-free (CVE-ID: CVE-2026-93288)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to failure to wait for an RCU grace period in nfnetlink_log per-network state when processing packets concurrently with network namespace teardown. A local user can trigger concurrent packet processing and network namespace teardown to trigger a use-after-free.

2391) Deadlock (CVE-ID: CVE-2026-93781)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock in scsi_eh_lock_door() when allocating a request during SCSI error recovery while all scheduler tags are in use. A local user can trigger SCSI error recovery under these conditions to cause a denial of service.

2392) Race condition (CVE-ID: CVE-2026-93782)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write response data to an unrelated userspace object.

The vulnerability exists due to a race condition in vhost-scsi ioctl handling when replacing the memory table while commands are in flight. A local user can submit commands and issue VHOST_SET_MEM_TABLE to write response data to an unrelated userspace object.

2393) Out-of-bounds read (CVE-ID: CVE-2026-93783)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read uninitialized memory.

The vulnerability exists due to an out-of-bounds read in rfcomm_recv_frame() when processing truncated Bluetooth RFCOMM frames. A remote attacker can send a truncated Bluetooth RFCOMM frame to read uninitialized memory.

A zero-length frame can cause a length underflow and make skb_tail_pointer() read past the buffer.

2394) Out-of-bounds read (CVE-ID: CVE-2026-93784)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper validation of information element buffers in cfg80211_wext_siwgenie() when storing a malformed buffer through SIOCSIWGENIE. A local user can submit a malformed information element buffer and trigger a connection attempt to cause a denial of service.

The issue is triggered when a subsequent SIOCSIWESSID operation initiates connection processing.

2395) Numeric Truncation Error (CVE-ID: CVE-2026-93785)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause inconsistent payload length interpretation.

The vulnerability exists due to improper validation of payload length in the cifs.idmap key type when processing oversized preparsed payloads. A local user can provide an oversized preparsed payload to cause inconsistent payload length interpretation.

2396) Incorrect permission assignment for critical resource (CVE-ID: CVE-2026-93786)

CWE-ID: CWE-732 - Incorrect Permission Assignment for Critical Resource

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to widen effective permissions on SMB-created objects.

The vulnerability exists due to improper permission assignment in the ksmbd VFS POSIX ACL inheritance handling when creating SMB objects in directories with default POSIX ACLs. A remote user can create an SMB object to widen effective permissions on that object.

Exploitation requires a parent directory with a default POSIX ACL containing a restrictive ACL_MASK entry.

2397) Out-of-bounds read (CVE-ID: CVE-2026-93787)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an out-of-bounds read.

The vulnerability exists due to improper bounds checking in cifs_filldir() when processing SMB1 TRANS2 directory enumeration responses. A remote attacker can return a directory entry with an oversized FileNameLength to cause an out-of-bounds read.

User interaction is required to list a directory on a CIFS mount served by an attacker-controlled SMB1 server.

2398) Reliance on undefined behavior (CVE-ID: CVE-2026-93788)

CWE-ID: CWE-758 - Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

CVSSv4: 0 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to trigger undefined behavior.

The vulnerability exists due to improper bounds checking in the WGDS table revision index handling when processing WGDS tables reporting an invalid revision value. An attacker with physical access can cause the kernel to process a WGDS table with an invalid revision value to trigger undefined behavior.

2399) Integer underflow (CVE-ID: CVE-2026-93789)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a length underflow.

The vulnerability exists due to improper validation of aligned TLV lengths in the iwlwifi firmware parser when processing malformed TLVs in a firmware image. A local user can cause the parser to process a firmware image containing malformed TLVs to cause a length underflow.

2400) Out-of-bounds write (CVE-ID: CVE-2026-93790)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write outside the bounds of an array.

The vulnerability exists due to improper array index validation in the iwl_mvm_rx_ba_notif handler when processing compressed block acknowledgment notifications. A local user can trigger processing of a compressed block acknowledgment notification containing an invalid TID to write outside the bounds of an array.

Multi-TID block acknowledgment is not generally in use.

2401) Improper Validation of Array Index (CVE-ID: CVE-2026-93791)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds memory access.

The vulnerability exists due to improper validation of an array index in the iwl_mvm_rx_ba_notif function when processing BA notifications from firmware. A local user can trigger processing of a BA notification containing an out-of-range TID to cause an out-of-bounds memory access.

2402) Integer underflow (CVE-ID: CVE-2026-93792)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer underflow in the iwl_mvm_report_wakeup_reasons() WoWLAN wakeup-reason packet handling when processing firmware-reported WoWLAN packets with undersized lengths. A local user can trigger processing of a firmware-reported WoWLAN packet with an undersized length to cause a denial of service.

2403) Out-of-bounds read (CVE-ID: CVE-2026-93793)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read.

The vulnerability exists due to improper length validation in TX_CMD response parsing in the iwlwifi mvm driver when processing TX_CMD responses with payloads shorter than the frame_count-dependent status layout. A local user can supply a malformed TX_CMD response to cause an out-of-bounds read.

2404) Race condition (CVE-ID: CVE-2026-93794)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause punched file ranges to be incorrectly reported as allocated data.

The vulnerability exists due to improper synchronization in the SMB client smb3_punch_hole function when punching a hole after a large buffered write. A local user can perform a large buffered write followed by a hole-punch operation to cause punched file ranges to be incorrectly reported as allocated data.

2405) Memory leak (CVE-ID: CVE-2026-93795)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause resource exhaustion.

The vulnerability exists due to improper reference count management in the blkg_create() error path when radix_tree_insert() fails. A local user can trigger a radix_tree_insert() failure during blkcg creation to cause resource exhaustion.

The blkcg group may be marked online despite not being fully inserted.

2406) Use-after-free (CVE-ID: CVE-2026-93796)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access freed memory.

The vulnerability exists due to a use-after-free condition in the iwlwifi PCIe RX cleanup routine when RX initialization fails and cleanup or retry paths are invoked. A local user can invoke the affected cleanup or retry paths after a failed RX initialization to access freed memory.

2407) Out-of-bounds read (CVE-ID: CVE-2026-93797)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read memory out of bounds.

The vulnerability exists due to an out-of-bounds read in the iwl_mvm_check_he_obss_narrow_bw_ru_iter function when processing an extended capability information element shorter than 11 bytes. A remote attacker can supply a malformed extended capability information element to read memory out of bounds.

2408) Race condition (CVE-ID: CVE-2026-93798)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause inconsistent relocation-root state.

The vulnerability exists due to improper synchronization in merge_reloc_roots() when merging relocation roots. A local user can trigger relocation-root cleanup to cause inconsistent relocation-root state.

The issue occurs when a root has zero root references in its root item.

2409) Improper Validation of Array Index (CVE-ID: CVE-2026-93799)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds array access.

The vulnerability exists due to improper validation of an array index in the iwl_mvm_window_status_notif BA window status notification handler when processing a BA window status notification. A local user can cause processing of a notification containing an invalid station ID to perform an out-of-bounds array access.

The station ID is extracted as a 5-bit value from the firmware notification and is used to index the fw_id_to_mac_id[] array.

2410) Use-after-free (CVE-ID: CVE-2026-93800)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the btrfs relocation root cleanup logic when handling errors returned by btrfs_update_reloc_root() during relocation. A local user can trigger relocation that encounters an error and unmount the filesystem to cause a denial of service.

2411) Use of Uninitialized Variable (CVE-ID: CVE-2026-93801)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect field values.

The vulnerability exists due to use of uninitialized stack memory in cifs_open_info_data in the SMB client when using affected SMB client operations. A local user can trigger affected SMB client operations to cause incorrect field values.

2412) Out-of-bounds write (CVE-ID: CVE-2026-93802)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in rsi_prepare_beacon() when preparing an oversized beacon frame. A local user can provide an oversized beacon frame to cause a denial of service.

2413) Out-of-bounds read (CVE-ID: CVE-2026-93803)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in libipw_rx() when processing crafted Wi-Fi frames. A remote attacker can send a specially crafted Wi-Fi frame to read out-of-bounds memory.

2414) Race condition (CVE-ID: CVE-2026-93804)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause packets to be transmitted to the driver after it has been told to leave an IBSS.

The vulnerability exists due to a race condition in ieee80211_ibss_disconnect() in mac80211 when disconnecting from an IBSS while transmissions are in flight. A local user can initiate an IBSS disconnect while packets are still being transmitted to cause packets to be transmitted to the driver after it has been told to leave an IBSS.

2415) Out-of-bounds read (CVE-ID: CVE-2026-93805)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read out-of-bounds memory.

The vulnerability exists due to improper frame length validation in the cfg80211_rx_mlme_mgmt() and cfg80211_tx_mlme_mgmt() callbacks when processing truncated MLME management frames. A local user can supply a truncated management frame to read out-of-bounds memory.

2416) Out-of-bounds read (CVE-ID: CVE-2026-93806)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in cfg80211_rx_assoc_resp() in the cfg80211 wireless subsystem when processing a short association response frame. A remote attacker can send a malformed association response frame to read out-of-bounds memory.

2417) Out-of-bounds read (CVE-ID: CVE-2026-93807)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in rsi_hal_load_key() in the rsi wireless driver when processing non-TKIP cipher keys. A local user can provide a non-TKIP cipher key with a shorter key layout to cause an out-of-bounds read.

2418) Out-of-bounds read (CVE-ID: CVE-2026-93808)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause an out-of-bounds read.

The vulnerability exists due to improper length validation in the ALSA USB CAIAQ EP1 reply handling code when processing undersized EP1 replies. An attacker with physical access can provide a malformed EP1 reply to cause an out-of-bounds read.

2419) Use-after-free (CVE-ID: CVE-2026-93809)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the AMDGPU module exit routine when unloading the AMDGPU module while call_rcu() callbacks remain pending. A local user can unload the module before pending callbacks complete to cause a denial of service.

2420) Double free (CVE-ID: CVE-2026-93810)

CWE-ID: CWE-415 - Double Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a double free.

The vulnerability exists due to a double fput in error handling in cachefiles_create_tmpfile() when the cache does not support read_iter and write_iter. A local user can trigger this error-handling path to cause a double free.

2421) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-93811)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak and an incorrect success result.

The vulnerability exists due to improper exceptional-condition handling in ksmbd_vfs_get_sd_xattr() when validating a decoded security descriptor size. A local user can trigger validation of a security descriptor smaller than struct smb_ntsd to cause a memory leak and an incorrect success result.

2422) Memory leak (CVE-ID: CVE-2026-93811)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to improper error-path resource cleanup in ksmbd_vfs_get_sd_xattr() when decoding an NT ACL. A local user can trigger an ndr_decode_v4_ntacl() failure to cause a memory leak.

2423) Memory leak (CVE-ID: CVE-2026-93812)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper memory release in ksmbd_vfs_set_sd_xattr when encoding NT ACL data. A remote attacker can cause an encoding operation to return an error after memory allocation to cause a denial of service.

2424) Out-of-bounds read (CVE-ID: CVE-2026-93813)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the Btrfs INODE_REF item handler when processing a crafted Btrfs image. A local user can provide a crafted Btrfs image with an oversized INODE_REF name length to cause a denial of service.

2425) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-93814)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in spi_controller_suspend() when suspending a system while an SPI controller in target mode has an active transfer. A local user can trigger system suspend during an active target-mode SPI transfer to cause a denial of service.

2426) Improper locking (CVE-ID: CVE-2026-93815)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an invalid wait context.

The vulnerability exists due to improper locking in au1000_close() in the au1000 Ethernet driver when stopping the network device. A local user can invoke the affected close operation to trigger an invalid wait context.

2427) Out-of-bounds read (CVE-ID: CVE-2026-93816)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in the f2fs inline dentry conversion routine when processing a corrupted filesystem image. A local user can provide a corrupted filesystem image containing an overlong inline dentry name to read out-of-bounds memory.

2428) Use-after-free (CVE-ID: CVE-2026-93817)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to improper lifetime management in event::addr_filter_ranges when address-filter ranges are accessed under RCU. A local user can cause address-filter ranges to be freed while they remain accessible under RCU to trigger a use-after-free condition.

2429) Use-after-free (CVE-ID: CVE-2026-93819)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in the MediaTek PCIe controller driver's root bus removal routine when stopping and removing a root bus concurrently with rescan or hotplug operations triggered via sysfs. A local user can trigger concurrent rescan or hotplug operations via sysfs to cause a denial of service.

2430) Use-after-free (CVE-ID: CVE-2026-93820)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free race condition in Rockchip PCIe host controller root bus removal when rescan or hotplug operations are triggered concurrently via sysfs. A local user can race root bus removal with concurrent rescan or hotplug operations to cause a denial of service.

2431) Race condition (CVE-ID: CVE-2026-93821)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in the Altera PCIe controller driver's root bus removal routine when concurrent rescan or hotplug operations are triggered through sysfs. A local user can trigger concurrent rescan or hotplug operations through sysfs to cause a denial of service.

2432) Use-after-free (CVE-ID: CVE-2026-93822)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a system crash.

The vulnerability exists due to a race condition in PCI iProc root bus removal when concurrently triggering sysfs rescan or hotplug operations. A local user can trigger concurrent sysfs rescan or hotplug operations to cause a system crash.

2433) Resource exhaustion (CVE-ID: CVE-2026-93823)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uncontrolled resource allocation in the AMDKFD_IOC_GET_DMABUF_INFO ioctl when processing user-supplied metadata buffer sizes. A local user can provide a hostile oversized metadata buffer size to cause a denial of service.

Exploitation requires membership in the render group.

2434) Improper input validation (CVE-ID: CVE-2026-93824)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger exploitable latent bugs.

The vulnerability exists due to improper input validation in the TLS socket option configuration when configuring TLS keys on a socket already in a sockmap. A local user can configure TLS keys on a socket already in a sockmap to trigger exploitable latent bugs.

2435) NULL pointer dereference (CVE-ID: CVE-2026-93825)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a missing null pointer check in spi_get_device_match_data() when processing an SPI device using driver_override without a matching SPI ID entry. A local user can use driver_override without a matching SPI ID entry to cause a denial of service.

2436) Use-after-free (CVE-ID: CVE-2026-93826)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to use-after-free in hidpp_connect_event() when input device registration fails. A local user can trigger a HID++ connection event after input device registration fails to cause a use-after-free condition.

2437) Integer overflow (CVE-ID: CVE-2026-93828)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer overflow in exfat_create_upcase_table() when processing an exFAT volume with an upcase table size of zero. A remote attacker can cause the kernel to process such a volume to trigger an infinite loop.

2438) Race condition (CVE-ID: CVE-2026-93829)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a race condition in cifsd demultiplex thread creation when initializing tcp_ses. A local privileged user can trigger the race during CIFS session creation to cause a denial of service.

2439) Resource exhaustion (CVE-ID: CVE-2026-93830)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper interrupt masking in the XGMAC2 stmmac driver when the DMA runs out of receive descriptors under heavy receive pressure. A remote attacker can generate heavy receive traffic to cause a denial of service.

2440) Unchecked Return Value (CVE-ID: CVE-2026-97407)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access hardware registers while the device state is undefined.

The vulnerability exists due to an unchecked return value in rockchip_pdm_set_fmt() when resuming runtime power management. A local user can request an audio interface format change during a runtime resume failure to access hardware registers while the device state is undefined.

2441) Out-of-bounds read (CVE-ID: CVE-2026-97408)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read beyond the advertised skb payload.

The vulnerability exists due to an out-of-bounds read in l2cap_recv_frame() when processing malformed connectionless L2CAP frames. A remote attacker can send a connectionless frame with an incomplete PSM payload to read beyond the advertised skb payload.

The read can use tailroom bytes as part of the PSM.

2442) Use of uninitialized resource (CVE-ID: CVE-2026-97409)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disable locking correctness validation.

The vulnerability exists due to use of an uninitialized resource in __nvme_fc_abort_outstanding_ios() when error recovery aborts outstanding requests before the I/O tagset is initialized. A local user can trigger an admin request timeout during controller connection to disable locking correctness validation.

The condition occurs while the NVMe over Fibre Channel controller is in the CONNECTING state.

2443) Infinite loop (CVE-ID: CVE-2026-97411)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper state management in the mal_remove() function of the IBM EMAC MAL driver when removing the affected module after NAPI has not been enabled or has already been disabled. A local privileged user can remove the affected module to cause a denial of service.

The condition can occur when no MACs were registered or when registered MACs were subsequently unregistered.

2444) Use-after-free (CVE-ID: CVE-2026-97412)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to failure to quiesce DMA in the pds_core driver's pdsc_teardown() function when tearing down resources while bus mastering remains enabled. A local user can cause the device to perform DMA after DMA buffers are freed to cause a use-after-free condition.

2445) Integer underflow (CVE-ID: CVE-2026-97413)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an out-of-bounds memory access.

The vulnerability exists due to integer underflow in the rtrs-srv process_read and process_write functions when processing a network-supplied RDMA message with usr_len greater than off. A remote attacker can send a crafted RDMA message with usr_len greater than off to cause an out-of-bounds memory access.

2446) Out-of-bounds write (CVE-ID: CVE-2026-97415)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds write.

The vulnerability exists due to improper validation of root reference name lengths in Btrfs ROOT_REF and ROOT_BACKREF item handling when processing malformed Btrfs root reference items. A local user can invoke BTRFS_IOC_GET_SUBVOL_INFO on a filesystem containing a malformed ROOT_BACKREF item to perform an out-of-bounds write.

2447) NULL pointer dereference (CVE-ID: CVE-2026-97416)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in btrfs_may_alloc_data_chunk() when processing corrupted Btrfs metadata during a balance operation. A local user can trigger a Btrfs balance operation on a filesystem whose chunk tree contains a chunk without a corresponding block group to cause a denial of service.

The issue occurs when CONFIG_BTRFS_ASSERT is disabled.

2448) Type conversion (CVE-ID: CVE-2026-97417)

CWE-ID: CWE-704 - Type conversion

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger an unaligned memory access.

The vulnerability exists due to an unsafe pointer cast in the tcp_sack() timestamp-only fast path when processing TCP options. A remote attacker can send a TCP packet containing unaligned options to trigger an unaligned memory access.

2449) NULL pointer dereference (CVE-ID: CVE-2026-97418)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in snd_es18xx_mixer when handling control allocation failures. A local user can trigger mixer control creation during an allocation failure to cause a denial of service.

2450) Exposure of Resource to Wrong Sphere (CVE-ID: CVE-2026-97419)

CWE-ID: CWE-668 - Exposure of resource to wrong sphere

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disclose sensitive information.

The vulnerability exists due to improper network namespace isolation in HSR generic netlink notification handling when broadcasting ring error and node down events. A local privileged user can listen for notifications from HSR devices in other network namespaces in init_net to disclose sensitive information.

The notifications expose the peer node MAC address and slave port interface index.

2451) Out-of-bounds read (CVE-ID: CVE-2026-97420)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to read out-of-bounds memory.

The vulnerability exists due to a missing NUL terminator in the bpf_sysctl_set_new_value helper when replacing a pending sysctl value through a cgroup/sysctl BPF program. A local privileged user can provide a replacement sysctl value without a terminating NUL byte to read out-of-bounds memory.

2452) Integer overflow (CVE-ID: CVE-2026-97421)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect page-size selection.

The vulnerability exists due to integer overflow in ib_umem_find_best_pgsz() in the RDMA/umem subsystem when handling a virtual address and length. A local user can provide values that trigger boundary conditions to cause incorrect page-size selection.

The issue is especially important on 32-bit systems.

2453) Out-of-bounds write (CVE-ID: CVE-2026-97425)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a buffer overflow.

The vulnerability exists due to improper bounds checking in the psp_vbflash sysfs binary attribute when writing vBIOS update data. A local user can write data beyond the maximum vBIOS buffer size to cause a buffer overflow.

2454) Heap-based buffer overflow (CVE-ID: CVE-2026-97427)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a heap-based buffer overflow.

The vulnerability exists due to a heap-based buffer overflow in pp_dpm_set_pp_table() when processing sysfs store writes larger than soft_pp_table_size. A local user can write oversized data through the sysfs store interface to cause a heap-based buffer overflow.

2455) Out-of-bounds read (CVE-ID: CVE-2026-97428)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read memory out of bounds.

The vulnerability exists due to improper bounds checking in the AMDGPU FRU EEPROM product information parser when parsing truncated or malformed FRU data. A local user can supply truncated or malformed FRU data to read memory out of bounds.

2456) Use-after-free (CVE-ID: CVE-2026-97429)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to a race condition in the drm/amdkfd queue destruction handling when concurrently destroying queues. A local user can initiate concurrent queue destruction to trigger a use-after-free condition.

2457) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-97430)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to queue new commands on the command ring while the xHC is inaccessible.

The vulnerability exists due to an improper check for an inaccessible hardware state in the xHCI command-ring queueing logic when the controller is suspended or resumed. A local user can initiate command queueing while the xHC is inaccessible to queue new commands on the command ring.

2458) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-97434)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause active NAPI instances to be deleted.

The vulnerability exists due to improper resource lifecycle management in the dpaa2-switch device removal path when removing a DPSW device. A local privileged user can trigger the device removal path to cause active NAPI instances to be deleted.

All NAPI instances are attached to the first switch port's net_device but are shared by all switch ports.

2459) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-97435)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to redirect traffic to an unintended port or trigger an out-of-bounds access.

The vulnerability exists due to improper validation of a destination port index in the SJA1105 flower classifier when configuring a redirect action to a switch port on a different switch chip. A local privileged user can configure a redirect action referencing a port from another switch chip to redirect traffic to an unintended port or trigger an out-of-bounds access.

2460) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-97436)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause multiple ports to share a forwarding database.

The vulnerability exists due to improper forwarding database state management in dpaa2_switch_port_set_fdb() when a port leaves a bridge while other ports continue to use the same forwarding database. A local privileged user can change bridge membership to cause multiple ports to share a forwarding database.

The issue occurs when multiple bridges have ports from the same DPSW instance.

2461) Out-of-bounds read (CVE-ID: CVE-2026-97437)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read.

The vulnerability exists due to improper bounds validation in the NTFS3 directory enumeration and index lookup paths when processing crafted NTFS index entries. A local user can provide a crafted NTFS image to cause an out-of-bounds read.

2462) Out-of-bounds read (CVE-ID: CVE-2026-97438)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a slab out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in the NTFS3 index entry processing when processing a malformed NTFS directory index entry during directory lookup. A local user can trigger directory lookup on an entry whose key_size exceeds the bytes available in its NTFS_DE payload to cause a slab out-of-bounds read.

2463) NULL pointer dereference (CVE-ID: CVE-2026-97439)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the ntfs3 extended attribute handler when modifying system.ntfs_attrib and system.dos_attrib on the same file in a corrupted ntfs3 image. A local user can toggle system.ntfs_attrib, overwrite system.dos_attrib, and write to the file to cause a denial of service.

2464) Memory leak (CVE-ID: CVE-2026-97440)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a missing reference release in qrtr_send_resume_tx() when allocation of a QRTR control packet fails. A local user can trigger the allocation failure path to cause a denial of service.

2465) Improper input validation (CVE-ID: CVE-2026-97441)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.1 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper validation of the mapped BAR size in the AHCI driver when probing an AHCI controller whose HOST_CAP register claims more ports than fit within the mapped BAR region. An attacker with physical access can trigger access to port registers beyond the BAR boundary to cause a denial of service.

2466) Memory corruption (CVE-ID: CVE-2026-97442)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to improper validation of native Wi-Fi header length in ath11k_dp_rx_h_undecap_nwifi() when processing hardware-provided packets using the DP_RX_DECAP_TYPE_NATIVE_WIFI decapsulation type. A remote attacker can provide a packet with a native Wi-Fi header length exceeding the maximum supported length to cause memory corruption.

2467) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-97443)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to improper state validation in perf_ftrace_function_unregister() when cleaning up a perf event whose ftrace operations registration failed or was already torn down. A local user can cause perf event cleanup to invoke unregister_ftrace_function() for ftrace operations that are not enabled to trigger a kernel warning.

2468) Out-of-bounds read (CVE-ID: CVE-2026-97444)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds access.

The vulnerability exists due to missing boundary checks in the ACPICA AML parser when parsing ACPI AML input. A local user can supply malformed AML input to cause an out-of-bounds access.

2469) Out-of-bounds read (CVE-ID: CVE-2026-97445)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read beyond the end of a buffer.

The vulnerability exists due to improper buffer validation in acpi_ut_walk_aml_resources() when processing malformed AML resource descriptors. A local user can provide a malformed AML resource descriptor whose length exceeds the remaining buffer size to read beyond the end of a buffer.

2470) NULL pointer dereference (CVE-ID: CVE-2026-97446)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in acpi_ns_custom_package() when processing a firmware-provided _BIX package whose first element is an unresolvable reference. A local user can cause the kernel to process such a package to cause a denial of service.

2471) Heap-based buffer overflow (CVE-ID: CVE-2026-97447)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a heap-based buffer overflow.

The vulnerability exists due to improper validation of OEM ID and OEM Table ID string lengths in acpi_ex_load_table_op() when loading an ACPI table. A local user can supply overlong OEM ID and OEM Table ID strings to cause a heap-based buffer overflow.

2472) Use-after-free (CVE-ID: CVE-2026-97448)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to improper validation of a namespace node in acpi_ns_build_normalized_path() when processing an invalid ACPI namespace node. A local user can cause the function to process an invalid namespace node to trigger a use-after-free condition.

2473) Memory corruption (CVE-ID: CVE-2026-97449)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds access.

The vulnerability exists due to improper restriction of operations within bounds in ACPICA parser functions when parsing package data with invalid package limits. A local user can trigger parsing of package data with invalid package limits to perform an out-of-bounds access.

2474) Type Confusion (CVE-ID: CVE-2026-97450)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access fields of a handler object without validating its type.

The vulnerability exists due to improper type validation in the ACPICA handler-list processing routines when walking handler lists. A local user can cause ACPICA to process a handler object with an invalid type to access fields of a handler object without validating its type.

2475) Integer overflow (CVE-ID: CVE-2026-97451)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an integer overflow in acpi_ex_opcode_3A_1T_1R() when calculating the truncation length for a String or Buffer operand. A local user can trigger the vulnerable operation with values that cause Index + Length to overflow to cause memory corruption.

2476) Improper input validation (CVE-ID: CVE-2026-97452)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper validation of reference classes in acpi_ut_copy_simple_object() when copying local, argument, or debug ACPI reference objects. A local user can cause the function to add a reference to an invalid object pointer to cause a denial of service.

2477) Out-of-bounds read (CVE-ID: CVE-2026-97453)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read beyond the bounds of an ACPI package buffer.

The vulnerability exists due to improper validation of an encoded package length byte count in acpi_ps_get_next_package_length() when parsing ACPI package lengths. A local user can cause the function to process an encoded byte count exceeding the remaining available bytes to read beyond the bounds of an ACPI package buffer.

2478) Out-of-bounds read (CVE-ID: CVE-2026-97454)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read beyond buffer bounds.

The vulnerability exists due to an out-of-bounds read in acpi_ps_get_next_field() when parsing malformed AML field data. A local user can cause malformed AML field data to be parsed to read beyond buffer bounds.

2479) Use-after-free (CVE-ID: CVE-2026-97455)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in acpi_ds_terminate_control_method() when terminating a control method whose return value is a ref_of reference. A local user can cause a control method to return a ref_of reference to trigger a use-after-free condition.

The affected reference can point to a method local variable or argument.

2480) Out-of-bounds read (CVE-ID: CVE-2026-97456)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access memory out of bounds.

The vulnerability exists due to an out-of-bounds read in acpi_ps_parse_loop() when checking for AML_ELSE_OP after skipping a While/If block. A local user can trigger the affected AML parsing condition to access memory out of bounds.

2481) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-97472)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to prevent generation of temporary IPv6 privacy addresses for an IPv6 prefix.

The vulnerability exists due to improper state management in the IPv6 addrconf temporary address management logic when handling router advertisements that deprecate and later restore an IPv6 prefix. A remote attacker can send router advertisements that temporarily deprecate and later restore a prefix to prevent temporary address regeneration.

2482) Memory leak (CVE-ID: CVE-2026-97473)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory release in rapl_add_package_cpuslocked() in the Intel RAPL powercap driver when handling a failed package addition caused by a negative physical package or logical die identifier. A local user can trigger a failed package addition to cause a denial of service.

2483) Use-after-free (CVE-ID: CVE-2026-97475)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger a use-after-free.

The vulnerability exists due to failure to unregister thermal cooling devices in the Tegra SoCTherm driver when the platform driver is removed. A local privileged user can cause the driver to be removed and trigger use of a stale thermal framework reference to trigger a use-after-free.

The stale cooling-device references retain devdata pointers to memory freed during platform-device cleanup.

2484) Missing Authorization (CVE-ID: CVE-2026-97476)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive network and socket information.

The vulnerability exists due to improper access control in the RDS_INFO_* getsockopt handlers when querying RDS information from a separate network namespace. A local user can call getsockopt with RDS_INFO_* options to disclose sensitive network and socket information.

Exploitation requires a fresh user namespace and network namespace.

2485) Improper handling of exceptional conditions (CVE-ID: CVE-2026-97481)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 4.1 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper handling of FIFO error interrupts in the 8250 serial driver when the serial interface receives a flood of messages during startup and encounters a FIFO error with no data ready. An attacker with physical access can send a flood of messages to the serial interface during startup to cause a denial of service.

2486) NULL pointer dereference (CVE-ID: CVE-2026-97482)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the goku_irq() interrupt handler when handling an INT_USBRESET event before a gadget driver is bound. An attacker with physical access can trigger an INT_USBRESET event before a gadget driver is bound to cause a denial of service.

2487) Deadlock (CVE-ID: CVE-2026-97483)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of memory allocation flags in USB core root hub control transfer handling when processing root hub control transfers during device-reset handling. A local user can trigger device-reset handling that submits a root hub control transfer to cause a denial of service.

The condition occurs in SCSI error-handler paths involving UAS or the storage driver.

2488) NULL pointer dereference (CVE-ID: CVE-2026-97484)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in status_show_vhci() in drivers/usb/usbip/vhci_sysfs.c when reading VHCI status after a VHCI host controller probe failure. A local user can read the VHCI status sysfs entry to cause a denial of service.

2489) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-97485)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of set_blocksize failures in the OMFS filesystem superblock initialization routine when mounting an OMFS filesystem with a block size larger than PAGE_SIZE. A local user can mount a specially crafted OMFS filesystem to cause a denial of service.

2490) Unchecked Return Value (CVE-ID: CVE-2026-97486)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an unchecked return value in the HPFS superblock mount handler when mounting an HPFS filesystem on a device with a block size greater than the page size. A local privileged user can mount the filesystem to trigger a kernel BUG condition and cause a denial of service.

2491) Unchecked Return Value (CVE-ID: CVE-2026-97487)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an unchecked return value in the JFS superblock initialization function jfs_fill_super when mounting a JFS filesystem with a block size greater than the page size. A local user can mount such a filesystem to cause a denial of service.

2492) Unchecked Return Value (CVE-ID: CVE-2026-97488)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an unchecked return value in qnx4_fill_super when mounting a QNX4 filesystem on a device whose block size causes sb_set_blocksize to fail. A local privileged user can mount the filesystem to trigger a kernel BUG.

2493) Unchecked Return Value (CVE-ID: CVE-2026-97489)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an unchecked return value in the bfs filesystem superblock initialization routine when mounting a BFS file system on a block device with a block size greater than PAGE_SIZE. A local user can mount a BFS file system on such a block device to cause a denial of service.

2494) Unchecked Return Value (CVE-ID: CVE-2026-97490)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of block size configuration failures in the AFFS filesystem mounting code when mounting an AFFS filesystem with a block size greater than PAGE_SIZE. A local user can mount a specially crafted AFFS filesystem to cause a denial of service.

2495) Resource exhaustion (CVE-ID: CVE-2026-97491)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in rds_ib_conn_path_shutdown when tearing down InfiniBand network configurations. A local user can initiate teardown of InfiniBand network configurations to cause a denial of service.

2496) Expired pointer dereference (CVE-ID: CVE-2026-97492)

CWE-ID: CWE-825 - Expired pointer dereference

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leave drivers with dangling pointers.

The vulnerability exists due to improper state cleanup in the mac80211 ieee80211_reconfig NAN reconfiguration failure handling when handling a failed NAN reconfiguration while other interfaces are present. A local user can trigger NAN reconfiguration processing that fails to leave drivers with dangling pointers.

The stale pointers can reference station and link objects.

2497) Out-of-bounds write (CVE-ID: CVE-2026-97494)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in the amdgpu PSP firmware-copy routine psp_copy_fw when copying an oversized firmware image into the PSP private buffer. A local user can invoke PSP firmware-loading operations with an oversized firmware image to cause memory corruption.

2498) Out-of-bounds write (CVE-ID: CVE-2026-97495)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds write.

The vulnerability exists due to improper bounds checking in the allocate_doorbell function when specifying a doorbell ID for restoration. A local user can provide a doorbell ID that exceeds the maximum number of queues per process to perform an out-of-bounds write.

The specific doorbell ID option is used by CRIU.

2499) Out-of-bounds read (CVE-ID: CVE-2026-97496)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the get_wave_state() function in drm/amdkfd when handling CRIU restore operations through AMDKFD_IOC_RESTORE_PROCESS with H3. A local user can supply crafted MQD control stack size and offset values to disclose sensitive information.

The exposed data can include adjacent GTT or kernel memory, such as other queues' MQDs, ring buffers, and KASLR pointers.

2500) Improper Validation of Array Index (CVE-ID: CVE-2026-97497)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access memory out of bounds.

The vulnerability exists due to improper validation of an array index in the allocate_sdma_queue function when handling a specified SDMA queue identifier during CRIU restoration. A local user can specify an out-of-range SDMA queue identifier to access memory out of bounds.

2501) Out-of-bounds read (CVE-ID: CVE-2026-97500)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an out-of-bounds read.

The vulnerability exists due to improper length validation in the rtw89 PHY status information element parser when processing PHY status information elements with unexpected lengths. A remote attacker can cause the parser to process a PHY status information element with an unexpected length to cause an out-of-bounds read.

2502) NULL pointer dereference (CVE-ID: CVE-2026-97502)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the mmc_davinci_irq() handler in the DaVinci MMC host driver when processing read data timeout or data CRC error interrupt status while no data request is present. A local user can trigger the affected interrupt handling condition to cause a denial of service.

2503) Missing Authorization (CVE-ID: CVE-2026-97505)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to missing authorization in the __resource_resize_store() function when writing to a resourceN_resize sysfs attribute. A local user can resize a PCI BAR to cause a denial of service.

2504) NULL pointer dereference (CVE-ID: CVE-2026-97506)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a null-pointer dereference.

The vulnerability exists due to improper handling of an allocation failure in chainup_buffers() in the ixp4xx crypto driver when constructing a buffer descriptor chain for a scatterlist. A local user can submit a crypto request that encounters an allocation failure to trigger a null-pointer dereference.

2505) Unchecked Return Value (CVE-ID: CVE-2026-97507)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an unchecked return value in dm1105_hw_init() when initializing dm1105 hardware after DMA memory allocation fails. A local user can trigger dm1105 hardware initialization to cause a denial of service.

2506) Use-after-free (CVE-ID: CVE-2026-97508)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the Thunderbolt XDomain request handler when handling a request from a remote host while a domain is stopped. A remote attacker can send a request during domain shutdown to cause a denial of service.

2507) Use-after-free (CVE-ID: CVE-2026-97509)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference counting in the Thunderbolt XDomain service lifetime handling when releasing an XDomain service. A local user can trigger service release after the parent XDomain is released to cause a denial of service.

2508) Memory leak (CVE-ID: CVE-2026-97510)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to a missing release of allocated memory in __tb_xdomain_response() when tb_cfg_request() fails to set up a request. A local user can trigger the failed request setup to cause a memory leak.

The issue can occur when the control channel has already been shut down.

2509) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-97512)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause clock and power imbalances.

The vulnerability exists due to incomplete error handling in the Qualcomm QSPI driver's runtime PM suspend and resume functions when a runtime PM operation fails midway. A local user can trigger a failure during a runtime PM suspend or resume operation to cause clock and power imbalances.

2510) Improper locking (CVE-ID: CVE-2026-97514)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger kernel lock validator reports.

The vulnerability exists due to calling sleeping V4L2 control operations while holding a spinlock in the Wave5 decoder's dynamic resolution change handling when processing dynamic resolution changes. A local user can cause the driver to process a dynamic resolution change to trigger kernel lock validator reports.

2511) NULL pointer dereference (CVE-ID: CVE-2026-97516)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in rtw_fw_adaptivity_result() in the rtw88 wireless driver when processing a firmware adaptivity result with an undefined edcca_th configuration. A local user can cause the driver to process a firmware adaptivity result to cause a denial of service.

The issue occurs on devices using the 8821CE chip, which does not define edcca_th in its chip information.

2512) Out-of-bounds read (CVE-ID: CVE-2026-97517)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds read.

The vulnerability exists due to improper length validation in nl80211 HE operation element handling when processing a malformed HE operation element in beacon data. A local user can supply a truncated HE operation element to trigger an out-of-bounds read.

2513) Out-of-bounds write (CVE-ID: CVE-2026-97518)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause memory corruption.

The vulnerability exists due to improper validation of duplicate cipher suite entries in cfg80211 wiphy registration when WEXT compatibility code handles SIOCGIWRANGE requests. A local privileged user can register a wiphy with duplicate WEP cipher suite entries and request wireless range information to cause memory corruption.

2514) Insufficient Control Flow Management (CVE-ID: CVE-2026-97520)

CWE-ID: CWE-691 - Insufficient Control Flow Management

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to modify data and cause a denial of service.

The vulnerability exists due to improper control flow management in gfs2_quota_init() when processing quota change entries. A remote attacker can exploit incorrect quota-change iterator progression to modify data and cause a denial of service.

User interaction is required.

2515) Incorrect calculation (CVE-ID: CVE-2026-97522)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect byte accounting.

The vulnerability exists due to improper accounting in __mptcp_subflow_push_pending() when __subflow_push_pending() returns an error. A local user can trigger an error during a pending subflow push to cause incorrect byte accounting.

2516) Race condition (CVE-ID: CVE-2026-97523)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a race condition in the mptcp scheduler when subflow socket states change. A remote attacker can trigger the race condition to cause a denial of service.

2517) Deadlock (CVE-ID: CVE-2026-97524)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state management in the MPTCP receive path when processing a subflow reset under exceptional error conditions. A remote attacker can trigger the exceptional error condition during MPTCP receive processing to cause a denial of service.

2518) Race condition (CVE-ID: CVE-2026-97527)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt kernel memory.

The vulnerability exists due to a race condition in the qla2xxx driver's fcport->unsol_ctx_head list when concurrently processing unsolicited NVMe contexts. A remote attacker can trigger concurrent additions and removals of list entries to corrupt kernel memory.

2519) Use-after-free (CVE-ID: CVE-2026-97528)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption or a denial of service.

The vulnerability exists due to a use-after-free in qla_nvme_xmt_ls_rsp() in the qla2xxx NVMe transport when handling an LS response error. A remote attacker can trigger an LS response error to cause memory corruption or a denial of service.

2520) Out-of-bounds read (CVE-ID: CVE-2026-97529)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the qla2xxx FC BSG vendor command handling when processing a short FC_BSG_HST_VENDOR request. A local privileged user can submit a short request with a matching vendor ID to trigger an out-of-bounds heap read.

Exploitation requires the CAP_SYS_RAWIO capability.

2521) Type Confusion (CVE-ID: CVE-2026-97530)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper interpretation of continuation IOCB payload data in the qla2xxx driver's qla27xx_copy_multiple_pkt() and qla27xx_copy_fpin_pkt() functions when processing a crafted Fibre Channel frame. A remote attacker can send a frame with payload bytes matching the RESPONSE_PROCESSED value to cause a denial of service.

The affected processing occurs in interrupt/DPC context.

2522) Use-after-free (CVE-ID: CVE-2026-97531)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.7 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to a use-after-free in the qla2xxx host_map lookup path when report ID acquisition races with virtual port teardown. A remote attacker can trigger report ID acquisition for a virtual port being deleted to cause memory corruption.

2523) Double free (CVE-ID: CVE-2026-97532)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in the qla2x00_mem_alloc() error-handling path when memory allocation fails during qla2x00_probe_one(). A local user can cause qla2x00_mem_alloc() to fail during device probing to cause a denial of service.

2524) Incorrect calculation (CVE-ID: CVE-2026-97534)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect free-section accounting in free_segment_range() when garbage collection migrates data from a truncated range. A local user can trigger garbage collection during range truncation to cause a denial of service.

Exploitation requires limited available filesystem space.

2525) Out-of-bounds write (CVE-ID: CVE-2026-97535)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause an out-of-bounds write.

The vulnerability exists due to improper bounds checking in the qla2xxx VP control IOCB handling when processing a virtual port index that exceeds the vp_idx_map bitmap capacity. A local privileged user can submit a VP control operation containing an out-of-range virtual port index to cause an out-of-bounds write.

Exploitation is limited to adapters whose reported NPIV virtual-port capacity permits virtual port indices above 128.

2526) Use-after-free (CVE-ID: CVE-2026-97536)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.7 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to use-after-free in the qla2xxx response queue work handling when tearing down a response queue with queued response work. A remote attacker can exploit the race condition during queue teardown to compromise confidentiality, integrity, and availability.

The condition is especially likely during full adapter teardown, which forces pending work to run after queue pairs have been freed.

2527) Race condition (CVE-ID: CVE-2026-97537)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to overwrite a request or response queue map entry.

The vulnerability exists due to a race condition in qla25xx_free_req_que() and qla25xx_free_rsp_que() when queue creation fails concurrently with another queue allocation. A local user can race queue creation and teardown to overwrite a request or response queue map entry.

2528) NULL pointer dereference (CVE-ID: CVE-2026-97537)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a kernel panic.

The vulnerability exists due to improper handling of a null DMA ring pointer in qla25xx_free_req_que() and qla25xx_free_rsp_que() when freeing a request or response queue after DMA allocation fails during queue creation. A local user can initiate queue creation when DMA allocation fails to cause a kernel panic.

2529) Out-of-bounds read (CVE-ID: CVE-2026-97539)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read memory out of bounds.

The vulnerability exists due to an out-of-bounds read in xusbatm_bind when binding a USB device through a dynamic ID. A local user can cause an invalid index to be used for USB interface configuration arrays to read memory out of bounds.

2530) Out-of-bounds read (CVE-ID: CVE-2026-97540)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access memory out of bounds.

The vulnerability exists due to improper pointer arithmetic in the pegasus USB network driver probe routine when processing a dynamically configured USB device ID. A local user can trigger calculation of an out-of-bounds index to access memory out of bounds.

2531) Use-after-free (CVE-ID: CVE-2026-97541)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access freed memory.

The vulnerability exists due to a use-after-free in the ath9k_htc USB driver when handling a dynamically matched USB device. A local user can cause the driver to dereference a stored usb_device_id pointer after the probe operation has completed to access freed memory.

2532) Unchecked Return Value (CVE-ID: CVE-2026-97542)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause inconsistent in-core data.

The vulnerability exists due to an unchecked return value in xrep_agfl_init_header when walking allocation-group free-list extents during XFS repair. A local user can trigger an error from xagb_bitmap_walk to cause inconsistent in-core data.

2533) Improper resource shutdown or release (CVE-ID: CVE-2026-97545)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a locked buffer to be leaked.

The vulnerability exists due to improper resource release in xfs_btree_bload_prep_block when handling an I/O error while writing the delayed-write buffer list to disk. A local user can cause the function to handle an I/O error during the write operation to cause a locked buffer to be leaked.

2534) Use of Uninitialized Variable (CVE-ID: CVE-2026-97552)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to use of an uninitialized variable in xfs_defer_finish_one() when processing an item-less pending item during an online repair. A local privileged user can trigger processing of an item-less pending item during an online repair to cause a denial of service.

Only kernels built with CONFIG_XFS_ONLINE_REPAIR are affected.

2535) Heap-based buffer overflow (CVE-ID: CVE-2026-97555)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in the SMB client DACL owner/group rewrite logic when rewriting an existing DACL containing short SIDs with replacement owner or group SIDs obtained through a cifs.idmap upcall. A remote attacker can cause rewritten access control entries to exceed the allocated buffer to execute arbitrary code.

User interaction is required.

2536) Memory leak (CVE-ID: CVE-2026-97556)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a missing reference count release in cifs_oplock_break() in the SMB client when handling an oplock break after cifs_sb_tlink() fails. A local user can trigger an oplock break that encounters a cifs_sb_tlink() failure to cause a denial of service.

Only SMB mounts using the multiuser option are affected.

2537) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-97557)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper reference count management in cifs_queue_oplock_break() when queueing oplock-break work. A remote attacker can trigger repeated oplock breaks while prior work remains queued to cause a denial of service.

The issue can be triggered when interacting with a slow-responding server.

2538) Memory leak (CVE-ID: CVE-2026-97558)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak kernel resources.

The vulnerability exists due to improper reference counting in cifs_close() deferred close handling when deferred close work is requeued while a prior execution is pending. A local user can open and close a reused handle while deferred close work is pending to leak kernel resources.

2539) Integer overflow (CVE-ID: CVE-2026-97559)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt a discretionary access control list (DACL).

The vulnerability exists due to an integer overflow in the SMB client DACL rewrite functions when rewritten access control entries cause a DACL to exceed 64K. A local user can trigger a DACL rewrite that exceeds 64K to corrupt a DACL.

The affected allocation covers the worst-case expansion, so writes remain within the allocated buffer.

2540) Out-of-bounds read (CVE-ID: CVE-2026-97560)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an out-of-bounds read.

The vulnerability exists due to an incorrect length calculation in smb2_parse_native_symlink() when parsing a share-root relative native symlink. A remote attacker can cause the client to parse a share-root relative native symlink with a crafted target to cause an out-of-bounds read.

2541) Use-after-free (CVE-ID: CVE-2026-97562)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to use-after-free in the SMB client DFS superblock lookup callback when handling DFS automounts during concurrent expiry. A remote attacker can trigger concurrent DFS automount expiry while the superblock is in use to compromise confidentiality, integrity, and availability.

User interaction is required.

2542) Missing Authorization (CVE-ID: CVE-2026-97564)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a root usermodehelper to process unvetted authority-bearing fields.

The vulnerability exists due to missing authorization validation in cifs.idmap key description handling when invoking request_key(2) with a non-NULL callout. A local user can supply a cifs.idmap key description containing authority-bearing fields to cause a root usermodehelper to process unvetted authority-bearing fields.

2543) Incomplete cleanup (CVE-ID: CVE-2026-97566)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to incomplete cleanup in the in-kernel MPTCP path manager's id 0 endpoint removal path when removing an id 0 endpoint while an ADD_ADDR announcement is pending. A local user can remove the id 0 endpoint while a pending ADD_ADDR announcement exists to trigger a kernel warning.

The warning is triggered when the path manager subsequently reselects id 0 after another signal endpoint is added.

2544) Race condition (CVE-ID: CVE-2026-97567)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause inconsistent connection status.

The vulnerability exists due to a race condition in the MPTCP disconnect handling in net/mptcp/protocol.c when disconnecting an MPTCP socket while its retransmission timer is running. A local user can trigger the concurrent disconnect and retransmission timer operations to cause inconsistent connection status.

2545) Use of Uninitialized Variable (CVE-ID: CVE-2026-97568)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incorrect handling of MPTCP backup state.

The vulnerability exists due to use of an uninitialized variable in MPTCP syncookie state handling when copying MPTCP subflow information. A remote attacker can trigger copying of MPTCP subflow information to cause incorrect handling of MPTCP backup state.

2546) Unchecked Return Value (CVE-ID: CVE-2026-97572)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a zeroed DMA address to be handed out.

The vulnerability exists due to an unchecked return value in bnxt_init_nic() when initializing RX rings after an allocation failure. A local user can trigger NIC initialization after RX ring allocation fails to cause a zeroed DMA address to be handed out.

2547) Unchecked Return Value (CVE-ID: CVE-2026-97573)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a loss of confidentiality, integrity, and availability.

The vulnerability exists due to unchecked return value in bnxt_rx_ring_reset() when resetting receive ring buffers after a buffer allocation failure. A remote attacker can trigger the vulnerable receive-ring reset to cause a loss of confidentiality, integrity, and availability.

2548) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-97575)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to improper validation of tile counts in the V4L2 AV1 frame control validation logic when processing V4L2 AV1 frame controls. A local user can submit a crafted control with excessive tile column or row counts to compromise confidentiality, integrity, and availability.

2549) Out-of-bounds read (CVE-ID: CVE-2026-97576)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to an out-of-bounds read in stateless HEVC decoder tile processing when processing a V4L2 HEVC PPS control with excessive tile counts. A local user can submit a crafted HEVC PPS control to compromise confidentiality, integrity, and availability.

2550) Out-of-bounds read (CVE-ID: CVE-2026-97577)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform out-of-bounds memory reads and writes.

The vulnerability exists due to improper bounds checking in rockchip_vpu981_av1_dec_prepare_run() and rockchip_vpu981_av1_dec_set_tile_info() when processing AV1 frames whose claimed tile count exceeds the submitted tile group entry count or the tile descriptor buffer capacity. A local user can submit a crafted AV1 frame with excessive tile dimensions to perform out-of-bounds memory reads and writes.

2551) Out-of-bounds write (CVE-ID: CVE-2026-97578)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to an out-of-bounds write in the tile_info DMA descriptor buffer when processing AV1 tile information. A local user can provide AV1 tile information that causes descriptor writes beyond the tile_info buffer to compromise confidentiality, integrity, and availability.

2552) Division by zero (CVE-ID: CVE-2026-97578)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to division by zero in rockchip_vpu981_av1_dec_set_tile_info() when processing AV1 tile information. A local user can provide an AV1 bitstream with zero tile columns to compromise confidentiality, integrity, and availability.

2553) Out-of-bounds write (CVE-ID: CVE-2026-97579)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in vdec_av1_slice_setup_tile() when processing AV1 bitstream tile information. A local user can provide crafted AV1 tile column or row counts to write beyond the mi_col_starts[] or mi_row_starts[] array capacity and execute arbitrary code.

2554) Out-of-bounds write (CVE-ID: CVE-2026-97581)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in prepare_tile_info_buffer() when processing HEVC picture parameter set tile dimensions. A local user can provide tile dimensions exceeding the tile_sizes DMA buffer capacity to cause memory corruption.

2555) Use-after-free (CVE-ID: CVE-2026-97582)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access freed memory.

The vulnerability exists due to use-after-free in the gpio-fan alarm work handler when unbinding a GPIO fan device while alarm work is pending. A local user can unbind the device after alarm work has been queued to access freed memory.

2556) Out-of-bounds read (CVE-ID: CVE-2026-97587)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the RISC-V performance monitoring unit counter mask handling when processing available counter masks on RV32 systems. A local user can trigger performance counter handling that iterates beyond the single unsigned long counter mask to disclose sensitive information.

On RV32 systems, the counter iteration limit is 64 while an unsigned long counter mask has only 32 bits.

2557) Sensitive Information in Resource Not Removed Before Reuse (CVE-ID: CVE-2026-97592)

CWE-ID: CWE-226 - Sensitive Information in Resource Not Removed Before Reuse

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to failure to clear sensitive data from memory in the s390 AES CTR and GCM cryptographic routines when processing cryptographic requests. A local user can process cryptographic requests that leave sensitive data in temporary buffers to disclose sensitive information.

2558) Use-after-free (CVE-ID: CVE-2026-97594)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to use-after-free in current_check_refer_path() in the Landlock filesystem access-control implementation when racing linkat(2) calls against concurrent rename(2) and rmdir(2) operations. A local user can race a linkat(2) loop against rename(2) and rmdir(2) to compromise confidentiality, integrity, and availability.

Exploitation requires entering a Landlock domain that handles at least one filesystem access right.

2559) Use-after-free (CVE-ID: CVE-2026-97595)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.7 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to use-after-free in mac802154 queued RX frame workers when processing received beacon and MAC-command frames during interface removal. A remote attacker can send MAC-command frames while an interface is removed to cause memory corruption.

2560) Improper Validation of Array Index (CVE-ID: CVE-2026-97596)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger an out-of-bounds transition table access.

The vulnerability exists due to improper validation of array indices in IPVS connection template synchronization record processing when processing a crafted IPVS synchronization record containing an invalid template state. A remote attacker can send a crafted IPVS synchronization record with an invalid template state to trigger an out-of-bounds transition table access.

The version 1 synchronization path handles both IPv4 and IPv6 records.

2561) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-97597)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to allocation of resources without limits in ipv6_flowlabel_get() when repeatedly requesting a shareable IPv6 flow label. A local user can submit repeated GET requests for the same shareable IPv6 flow label to cause a denial of service.

2562) Resource exhaustion (CVE-ID: CVE-2026-97598)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in fib_empty_table() in IPv4 FIB rules when adding an IPv4 rule with automatic table assignment. A local user can populate table IDs and add a table-0 rule to cause a denial of service.

Only the IPv4 automatic table-assignment path is affected.

2563) Double free (CVE-ID: CVE-2026-97599)

CWE-ID: CWE-415 - Double Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in hwsim_update_pib() when concurrent PIB updates occur on the same hwsim PHY. A local user can trigger concurrent PIB updates to cause a denial of service.

2564) NULL pointer dereference (CVE-ID: CVE-2026-97601)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the lowpan_newlink function when processing an RTM_NEWLINK request for a TUN device whose link-layer type has been changed to ARPHRD_IEEE802154. A local privileged user can issue an RTM_NEWLINK request to cause a denial of service.

2565) Out-of-bounds write (CVE-ID: CVE-2026-97602)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to an out-of-bounds write caused by stale reassembly metadata in IPv6 fragment reassembly when processing IPv6 fragments after fragment queue teardown. A local user can send crafted IPv6 fragments to escalate privileges.

Exploitation requires unprivileged network namespaces to be available.

2566) Use-after-free (CVE-ID: CVE-2026-97604)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a use-after-free in vfb colormap cleanup when a concurrent driver unbind occurs while FBIOGETCMAP copies a colormap to userspace. A local user can retain an open framebuffer file reference and invoke FBIOGETCMAP during a driver unbind to disclose sensitive information.

2567) NULL pointer dereference (CVE-ID: CVE-2026-97605)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of failed LZMA decoder allocations in the EROFS LZMA decoder pool resize path when resizing decoder pools. A local user can trigger a decoder-pool resize that encounters an allocation failure to cause a denial of service.

An existing LZMA mount is required.

2568) Memory leak (CVE-ID: CVE-2026-97606)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource release in autofs_fill_super() when creating an autofs root inode. A local user can trigger the root inode creation failure path after a new inode is allocated to cause a denial of service.

2569) Memory leak (CVE-ID: CVE-2026-97607)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a resource leak.

The vulnerability exists due to improper cleanup on an error path in the ifcvf_vdpa_dev_add function when provisioning unsupported device features. A local user can provision unsupported features to cause a resource leak.

2570) Use-after-free (CVE-ID: CVE-2026-97608)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service, disclose sensitive information, or modify data.

The vulnerability exists due to a race condition leading to a use-after-free in the netfilter nf_log logger backends when unregistering logger backends during per-network namespace teardown. A local user can rebind a logger through a sysctl or netlink writer after the prior per-network logger selection has been cleared to cause a denial of service, disclose sensitive information, or modify data.

2571) Use-after-free (CVE-ID: CVE-2026-97609)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information, modify data, or cause a denial of service.

The vulnerability exists due to a use-after-free in the nfnetlink_cttimeout timeout hook handling when a timeout policy lookup races with module unload. A local user can trigger a timeout policy lookup during module unload to disclose sensitive information, modify data, or cause a denial of service.

2572) Use-after-free (CVE-ID: CVE-2026-97611)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code, disclose sensitive information, or cause a denial of service.

The vulnerability exists due to a use-after-free in the Open vSwitch flow table mask array when processing packets during flow table statistics lookup. A local user can trigger concurrent flow table mask array reallocation and packet processing to execute arbitrary code, disclose sensitive information, or cause a denial of service.

2573) Signed to Unsigned Conversion Error (CVE-ID: CVE-2026-97612)

CWE-ID: CWE-195 - Signed to Unsigned Conversion Error

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to stale inner protocol state in skb_mpls_pop() when Open vSwitch re-pushes MPLS after all labels have been popped and the packet has been recirculated. A local user can trigger MPLS label push, pop, recirculation, and a subsequent label push to cause memory corruption.

2574) Resource exhaustion (CVE-ID: CVE-2026-97613)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper completion queue sizing in the MANA network driver's RX completion queue when processing receive completions while the queue is full. A remote attacker can cause the receive completion queue to become full while a fence completion is pending to cause a denial of service.

The dropped fence completion can cause the driver to hold the RTNL lock for the timeout duration.

2575) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-97615)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to corrupt list state on another bridge.

The vulnerability exists due to reuse of a global frame-type handler list node in the Linux bridge CFM and MRP frame handlers when enabling a protocol on multiple bridges and unregistering it on one bridge. A local privileged user can create protocol instances on multiple bridges and remove an instance from one bridge to corrupt list state on another bridge.

2576) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-97616)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by exhausting action IDs.

The vulnerability exists due to improper resource release in tcf_action_destroy() in net/sched/act_api.c when processing a batched RTM_NEWACTION request that replaces an existing action and a later action fails to initialize. A local user can submit a crafted batched RTM_NEWACTION request to cause a denial of service by exhausting action IDs.

2577) Deadlock (CVE-ID: CVE-2026-97619)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization of write accounting in the io_uring read/write completion handling when asynchronous writes complete while filesystem shutdown is freezing the superblock. A local user can issue an asynchronous write and initiate filesystem shutdown to cause a denial of service.

The condition occurs when the ring owner blocks in freeze_super() before queued task work runs.

2578) Sensitive Information in Resource Not Removed Before Reuse (CVE-ID: CVE-2026-97620)

CWE-ID: CWE-226 - Sensitive Information in Resource Not Removed Before Reuse

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper cache flushing in the drm/xe emit_render_cache_flush() function when releasing graphics memory for reuse. A local user can access reused graphics memory to disclose sensitive information.

2579) Memory leak (CVE-ID: CVE-2026-97899)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to improper memory release in query_perf_config_list() when memory reallocation fails. A local user can trigger a performance configuration list query when memory reallocation fails to cause a memory leak.

2580) Infinite loop (CVE-ID: CVE-2026-97900)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper loop control in drm_exec_prepare_array() when processing chained calls that include an empty object array after lock contention. A local user can invoke affected DRM ioctls to cause a denial of service.

This condition affects drivers that prepare separate read and write buffer-object arrays during one locking iteration.

2581) Use-after-free (CVE-ID: CVE-2026-97901)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the generic netlink controller policy dump handling when advancing a pending policy dump. A local user can initiate and advance a policy dump to cause a denial of service.

Exploitation requires the target generic netlink family to be unregistered and its module unloaded while the dump remains pending.

2582) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-97902)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper error handling in thaw_super_locked() when handling nested filesystem thaw operations. A local privileged user can cause bdev_thaw() to retain an elevated filesystem-freeze count after releasing a freeze hold to cause a denial of service.

The condition occurs when a FIFREEZE freeze is nested with bdev_freeze().

2583) Improper initialization (CVE-ID: CVE-2026-97904)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger access to an uninitialized semaphore.

The vulnerability exists due to improper initialization in cpufreq_policy_alloc() when accessing policy sysfs attributes during policy creation. A local user can access a policy sysfs attribute before policy->rwsem is initialized to trigger access to an uninitialized semaphore.

2584) Use of uninitialized resource (CVE-ID: CVE-2026-97905)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to invoke sysfs attribute callbacks on an uninitialized cpufreq policy.

The vulnerability exists due to use of uninitialized memory in the policy->cpus cpumask in cpufreq_policy_alloc() when a cpufreq policy is published to sysfs before initialization completes. A local user can access sysfs attributes during this initialization window to invoke callbacks on the uninitialized policy.

Only systems configured with CONFIG_CPUMASK_OFFSTACK=y are affected by the uninitialized separately allocated bitmap.

2585) Integer overflow (CVE-ID: CVE-2026-97906)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in get_boot_config_from_initrd() when processing a crafted initrd bootconfig. A local user can supply a crafted initrd with a huge bootconfig size to cause a denial of service.

The issue can trigger during early boot on 32-bit systems; 64-bit systems are also affected when the initrd exceeds 4.29 GB.

2586) Use of Uninitialized Variable (CVE-ID: CVE-2026-97907)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause firmware parsing to fail.

The vulnerability exists due to use of an uninitialized variable in rtlbt_parse_firmware_v2() when parsing firmware format v2 security headers with a zero chip key ID. A local user can trigger parsing of firmware containing a security header to cause firmware parsing to fail.

2587) Use-after-free (CVE-ID: CVE-2026-97908)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in the btqcomsmd Bluetooth driver when the command or ACL RPMsg endpoint receives data during device teardown. A remote attacker can trigger delivery of data from WCNSS during device teardown to cause an endpoint callback to dereference an already freed hci_dev.

2588) Use of uninitialized resource (CVE-ID: CVE-2026-97909)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger use of an uninitialized IRQ lock.

The vulnerability exists due to improper initialization in the ASoC STI UniPerif reader initialization routine when a pending shared interrupt is handled before the IRQ lock is initialized. A local user can cause the shared interrupt handler to run during initialization to trigger use of an uninitialized IRQ lock.

2589) Out-of-bounds write (CVE-ID: CVE-2026-97910)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to improper validation of buffer sizes in sprd_platform_compr_copy() in the ASoC sprd PCM compression driver when handling user-configured compression buffer parameters and write data. A local user can configure oversized compression buffer parameters and write data to overflow fixed IRAM or DDR buffer allocations.

The copy callback can be reached while the stream is in the setup state without starting it.

2590) Out-of-bounds read (CVE-ID: CVE-2026-97915)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disclose adjacent bytes from a shared tracing buffer.

The vulnerability exists due to an out-of-bounds read in the ivpu firmware log name printing routines when processing a firmware-provided log name that is not NUL-terminated. A local privileged user can cause the firmware log name to be printed to disclose adjacent bytes from the shared tracing buffer.

2591) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-97916)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds memory access.

The vulnerability exists due to a time-of-check to time-of-use race condition in fw_log_print_buffer() in the Intel VPU firmware log handling code when the NPU firmware modifies shared tracing log metadata after validation. A local user can cause the firmware-controlled log header size or log size values to change between validation and use to cause an out-of-bounds memory access.

2592) Out-of-bounds read (CVE-ID: CVE-2026-97917)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read memory outside the intended buffer.

The vulnerability exists due to an out-of-bounds read in ivpu_to_cpu_addr() when processing IPC messages containing buffer addresses. A local user can cause IPC processing to use an address range that extends beyond the buffer to read memory outside the intended buffer.

2593) Use-after-free (CVE-ID: CVE-2026-97918)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in histogram trigger registration cleanup when enabling a histogram trigger fails. A local user can cause histogram trigger enablement to fail, leaving a freed trigger referenced by the named trigger list, to trigger a use-after-free condition.

2594) Use-after-free (CVE-ID: CVE-2026-97919)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free read.

The vulnerability exists due to an incorrect reference-counting order in event_hist_trigger_named_init() when initialization of a named histogram trigger fails because alloc_hist_pad() cannot allocate. A local user can cause initialization to fail and subsequently look up the trigger by name to trigger a use-after-free read.

2595) Signed to Unsigned Conversion Error (CVE-ID: CVE-2026-97920)

CWE-ID: CWE-195 - Signed to Unsigned Conversion Error

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a signed-to-unsigned conversion error in the print_entries() cleanup path when reading the hist file of a trigger while histogram statistics allocation fails. A local user can read the hist file of a trigger with a .percent value to cause a denial of service.

The affected code path is not reachable in mainline while .percent and .graph modifiers are rejected for values.

2596) Memory leak (CVE-ID: CVE-2026-97921)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in __create_val_field() when processing histogram triggers containing unsupported field modifiers. A local user can write a crafted histogram trigger with a disallowed modifier to cause a denial of service.

2597) Memory leak (CVE-ID: CVE-2026-97922)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to improper memory management in histogram variable reference handling in the tracing subsystem when removing a histogram trigger that references the same variable three or more times. A local user can create a histogram trigger with repeated references to the same variable to cause a memory leak.

2598) Memory leak (CVE-ID: CVE-2026-97923)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to improper memory management in create_var_ref() in the tracing histogram implementation when initialization of a VAR_REF histogram field fails. A local user can trigger VAR_REF histogram field initialization failure to cause a memory leak.

2599) Improper handling of exceptional conditions (CVE-ID: CVE-2026-97924)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leave a registered trace event in an inconsistent state.

The vulnerability exists due to improper handling of event-removal failures in destroy_user_event() when removing an enabled user event. A local user can attempt to remove an enabled user event to leave a registered trace event in an inconsistent state.

2600) Race condition (CVE-ID: CVE-2026-97925)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a race condition in tick broadcast device handling when a broadcast device is replaced concurrently with tick broadcast operations. A local privileged user can cause a detached clock event device to be armed, triggering a kernel BUG.

The BUG condition occurs when the original broadcast device has a restricted interrupt-affinity mask and the last CPU in that mask goes offline.

2601) Out-of-bounds write (CVE-ID: CVE-2026-97926)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an out-of-bounds memory access.

The vulnerability exists due to improper validation of cylinder group metadata in ufs_read_cylinder() when processing a crafted UFS filesystem image. A remote attacker can provide malformed cylinder group metadata to cause an out-of-bounds memory access.

User interaction is required.

2602) NULL pointer dereference (CVE-ID: CVE-2026-97927)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in UFS superblock teardown when mounting a crafted writable UFS filesystem image whose first cylinder group cannot be read. A local user can mount a crafted UFS filesystem image to cause a denial of service.

2603) Use of Uninitialized Variable (CVE-ID: CVE-2026-97929)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to use of uninitialized heap data in the i_usx2y_in04_int() interrupt callback when handling a short transfer from a USB device. An attacker with physical access can cause a short transfer to disclose sensitive information.

The uninitialized data is copied to the mmap-accessible ctl_snapshot[] array.

2604) Out-of-bounds read (CVE-ID: CVE-2026-97930)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to read memory beyond the source buffer.

The vulnerability exists due to an out-of-bounds read in the ALSA usbusx2y driver when handling USB interrupt data during initialization. An attacker with physical access can trigger the initialization path to read three bytes past the end of the in04_buf allocation.

2605) Improper privilege management (CVE-ID: CVE-2026-97931)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to improper memory mapping permission handling in the ALSA us122l hwdep mmap callback when using mprotect() on a read-buffer mapping after opening the hwdep node O_RDWR. A local user can upgrade the read-buffer mapping to writable and modify the read_size member to cause memory corruption.

The read VMA remains expandable because pcm_usb_stream uses mremap() after reading read_size.

2606) Use-after-free (CVE-ID: CVE-2026-97933)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a use-after-free in tracer option file opening in tracefs when a trace instance is removed concurrently. A local privileged user can open a tracer option file while removing a trace instance to cause a denial of service.

2607) Memory corruption (CVE-ID: CVE-2026-97934)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of placeholder stacktrace fields in trace event histogram processing when parsing a histogram trigger with a STACKTRACE key. A local user can configure a histogram trigger using the STACKTRACE key and generate a trace event to cause a denial of service.

2608) Use-after-free (CVE-ID: CVE-2026-97935)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in hist_register_trigger() when registering a named histogram trigger using common_timestamp with an unknown trace clock. A local user can write a crafted histogram trigger with an unknown clock and then create another trigger with the same name to cause a denial of service.

2609) Out-of-bounds write (CVE-ID: CVE-2026-97936)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the tracing histogram stacktrace handling when configuring a histogram trigger with the .stacktrace modifier on a non-stacktrace field. A local user can write a crafted histogram trigger configuration to corrupt memory.

2610) Use-after-free (CVE-ID: CVE-2026-97938)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free race condition in cad_pid pointer handling when concurrently accessing the cad_pid sysctl from user and PID namespaces. A local user can trigger concurrent sysctl operations to cause a denial of service.

2611) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-97939)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to missing memory accounting in IPv4 and IPv6 multicast routing table allocations when creating multicast routing tables with MRT_TABLE or MRT6_TABLE. A local privileged user can create many multicast routing tables to cause a denial of service.

Exploitation requires netadmin privileges in a user and network namespace.

2612) Use-after-free (CVE-ID: CVE-2026-97940)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service, disclose sensitive information, or modify information.

The vulnerability exists due to a use-after-free in the IPv6 FIB route iterator walker handling when stopping an IPv6 route iterator while routes are deleted. A local user can trigger a race that leaves a freed walker on the IPv6 FIB walker list to cause a denial of service, disclose sensitive information, or modify information.

The same stop helper is used by /proc/net/ipv6_route and the BPF IPv6 route iterator.

2613) Incorrect calculation (CVE-ID: CVE-2026-97945)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause data loss.

The vulnerability exists due to incorrect preservation of the dirty bit in pmd_modify() when changing memory protections on PMD-mapped transparent huge pages. A local user can use MADV_FREE and change memory protections under memory pressure to cause data loss.

NUMA hinting can also trigger the issue.

2614) Deadlock (CVE-ID: CVE-2026-97948)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to recursive locking in eeh_rmv_device when handling EEH error events. A local user can trigger the affected EEH error-handling path to cause a denial of service.

The issue occurs for errors detected directly on the PHB or when a driver requests a reset but does not provide EEH error handlers.

2615) Use-after-free (CVE-ID: CVE-2026-97949)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in the configfs directory removal and symlink target-resolution logic when resolving a configfs symlink target while its directory is being removed. A local user can race a symlink operation with removal of its target directory to trigger a use-after-free condition.

2616) Use-after-free (CVE-ID: CVE-2026-97950)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to use-after-free in configfs symlink handling when racing symlink creation with removal of its target directory. A local user can race symlink creation with removal of the target directory to trigger a kernel warning.

2617) Deadlock (CVE-ID: CVE-2026-97951)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper command completion in the iSCSI target dataout handler when processing final dataout PDUs for a WRITE command aborted by a LUN reset. A remote user can send remaining dataout PDUs to cause a denial of service.

2618) Out-of-bounds write (CVE-ID: CVE-2026-97953)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt the TX ring.

The vulnerability exists due to an out-of-bounds write in the stmmac_tso_xmit() TX descriptor availability check when processing highly fragmented TSO traffic. A remote attacker can trigger transmission of a highly fragmented TSO packet to corrupt the TX ring.

2619) Out-of-bounds read (CVE-ID: CVE-2026-97954)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt the TCP RDS stream.

The vulnerability exists due to an out-of-bounds read in rds_message_map_pages() when transmitting RDS-TCP data on systems with page sizes greater than 8192 bytes. A remote attacker can trigger transmission of the congestion map to corrupt the TCP RDS stream.

2620) Heap-based buffer overflow (CVE-ID: CVE-2026-97957)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a heap-based buffer overflow.

The vulnerability exists due to improper bounds checking in check_mbox_seq_id_and_seg_len() in the hinic driver mailbox receive handler when processing mailbox segments. A local user can send a mailbox segment whose final sequence segment exceeds the remaining receive-buffer space to cause a heap-based buffer overflow.

2621) Infinite loop (CVE-ID: CVE-2026-97958)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of EAGAIN errors in tc_ctl_chain() when processing repeated RTM_GETCHAIN requests without consuming netlink responses. A local user can send repeated RTM_GETCHAIN requests without reading the responses to cause a denial of service.

2622) Memory leak (CVE-ID: CVE-2026-97959)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to a failure to free an emptied route4 bucket in net/sched/cls_route.c route4_change when moving an existing route filter to a different top-level bucket and deleting it. A local user can move an existing route filter to a different top-level bucket and then delete it to cause a memory leak.

The issue requires CONFIG_NET_CLS_ROUTE4, CONFIG_NET_SCH_INGRESS, and CONFIG_NET_CLS_ACT to be enabled.

2623) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-97961)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt the scheduler callback list.

The vulnerability exists due to unsafe list iteration in perf_pmu_sched_task() when processing perf PMU scheduler callbacks. A local user can invoke PERF_EVENT_IOC_REFRESH on a perf event to corrupt the scheduler callback list.

The issue is triggered when the event limit reaches zero during perf event overflow processing.

2624) Improper initialization (CVE-ID: CVE-2026-97963)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger undefined behavior.

The vulnerability exists due to improper initialization in the stmmac driver's ptp_lock when offloading a TAPRIO schedule while the interface is down. A local user can configure a TAPRIO schedule to trigger undefined behavior.

The issue occurs when the interface has never been opened.

2625) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-97964)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to modify data visible to an AF_PACKET socket.

The vulnerability exists due to failure to ensure a writable skb header in ppp_sync_txmunge() when bridging a received PPP frame to a synchronous tty channel. A remote attacker can send a PPPoE frame that is bridged to a synchronous tty channel to modify data visible to an AF_PACKET socket.

Exploitation requires the frame buffer to be shared with a clone queued to an AF_PACKET socket.

2626) Use of Uninitialized Variable (CVE-ID: CVE-2026-97965)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disclose uninitialized kernel stack data.

The vulnerability exists due to use of an uninitialized stack variable in vxlan_xmit_one() when transmitting a packet through a VXLAN device using external tunnel information that lacks the IP_TUNNEL_VXLAN_OPT_BIT flag. A local privileged user can transmit such a packet to disclose uninitialized kernel stack data.

The VXLAN device must be configured with both VXLAN_F_COLLECT_METADATA and VXLAN_F_GBP.

2627) Incomplete cleanup (CVE-ID: CVE-2026-97966)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to affect scheduler topology settings for later queue allocations.

The vulnerability exists due to incomplete cleanup of scheduler topology state in the OcteonTX2 PF QoS scheduler queue teardown logic when freeing QoS-allocated scheduler queues. A local user can trigger QoS scheduler hierarchy teardown to affect scheduler topology settings for later queue allocations.

PRIO_ANCHOR and RR_PRIO settings can persist in the shared scheduler pool.

2628) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-97969)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in msc313e_wdt_settimeout() when setting a watchdog timeout. A local user can set a watchdog timeout to cause a denial of service.

2629) Division by zero (CVE-ID: CVE-2026-97970)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to division by zero in the msc313e watchdog driver's msc313e_wdt_probe function when initializing a watchdog device with a zero clock rate. A local privileged user can trigger watchdog device initialization with a zero clock rate to cause a denial of service.

2630) Memory leak (CVE-ID: CVE-2026-97973)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to leak phylink instances.

The vulnerability exists due to improper resource management in the macb driver probe error path when handling a failed macb_alloc_tieoff() or register_netdev() operation. A local privileged user can trigger a driver probe failure to leak phylink instances.

2631) Use-after-free (CVE-ID: CVE-2026-97977)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Bluetooth USB driver rx_work handler when processing a device disconnect while receive work is running. A local user can trigger a device disconnect while the receive work dereferences freed btusb_data to cause a denial of service.

2632) Use-after-free (CVE-ID: CVE-2026-97978)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a trace event error.

The vulnerability exists due to use-after-free in the Intel Ethernet Controller (ice) driver trace event definitions when printing previously recorded trace events. A local user can trigger an affected trace event to trigger a trace event error.

The affected trace events are ice_rx_dim_work and ice_tx_dim_work.

2633) Memory leak (CVE-ID: CVE-2026-97979)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to improper resource release in the ICE driver's sched_node_ids xarray when cleaning up initialized hardware. A local user can trigger repeated hardware initialization and deinitialization to cause a memory leak.

2634) Resource exhaustion (CVE-ID: CVE-2026-97981)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper NAPI work budget accounting in the Cortina Gemini Ethernet driver's gmac_rx receive loop when processing malformed Ethernet frames. A remote attacker can send a stream of malformed Ethernet frames to cause a denial of service.

2635) Incorrect calculation (CVE-ID: CVE-2026-97982)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to incorrect budget accounting in gmac_rx() and gmac_napi_poll() when handling received packets during NAPI polling. A remote attacker can cause an idle poll to report a full budget and remain scheduled to cause a denial of service.

2636) Integer overflow (CVE-ID: CVE-2026-97984)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a kernel warning.

The vulnerability exists due to an integer overflow in IPv6 UDP socket cork handling when sending a large UDP payload with IPv6 path MTU discovery set to IPV6_PMTUDISC_DO or IPV6_PMTUDISC_PROBE over a network device with an unusually large MTU. A local privileged user can configure the device MTU and send a crafted UDP payload to cause a kernel warning.

The issue is limited to UDP sockets; raw IPv6 sockets can send UDP jumbograms.

2637) Infinite loop (CVE-ID: CVE-2026-97985)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the AF_UNIX stream socket out-of-band data handling when processing MSG_PEEK receive operations after skipped out-of-band socket buffers. A local user can send out-of-band data and issue MSG_PEEK receive calls to cause a denial of service.

2638) Use-after-free (CVE-ID: CVE-2026-97986)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to a race condition in virtinput_remove() and virtinput_recv_events() when a virtio input callback runs during input-device unregistration. A local user can cause a callback that passed the ready-state check to access vi->idev after it is freed to trigger a use-after-free.

The lifetime issue is not protected for sleepable callbacks on transports other than PCI and MMIO.

2639) Improper resource shutdown or release (CVE-ID: CVE-2026-97987)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause DMA access to torn-down virtqueues.

The vulnerability exists due to improper resource shutdown in the virtio_input probe error path when handling a failed input device registration. A local user can trigger the failed registration path to cause DMA access to torn-down virtqueues.

The device is marked DRIVER_OK before input device registration is attempted.

2640) Signed to Unsigned Conversion Error (CVE-ID: CVE-2026-97990)

CWE-ID: CWE-195 - Signed to Unsigned Conversion Error

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information and cause a denial of service.

The vulnerability exists due to improper handling of signed return values in the vdpa_sim_net TX/RX processing path when handling a failed TX pull. A local user can trigger processing of a failed TX pull to disclose sensitive information and cause a denial of service.

2641) Out-of-bounds write (CVE-ID: CVE-2026-97991)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read from and write to out-of-bounds memory.

The vulnerability exists due to improper range validation in vdpasim_blk_check_range() when processing virtio block requests with an out-of-range sector start. A local user can submit a crafted virtio block request to read from and write to out-of-bounds memory.

2642) Use-after-free (CVE-ID: CVE-2026-97992)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the vhost-vdpa configuration eventfd context handling when configuration callbacks run concurrently with configuration call replacement. A local user can inject configuration interrupts while another thread replaces the configuration call file descriptor to cause a denial of service.

Reachability is described for VDUSE parent devices.

2643) Race condition (CVE-ID: CVE-2026-97993)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in vhost_vdpa_set_config_call() when installing a configuration eventfd context. A local user can supply an invalid eventfd descriptor while setting the configuration callback to cause a denial of service.

A configuration interrupt delivered during the error-handling window can pass an error pointer to eventfd_signal().

2644) Out-of-bounds read (CVE-ID: CVE-2026-97994)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read memory beyond the mapped descriptor ring.

The vulnerability exists due to an out-of-bounds read in the vhost/vdpa VHOST_SET_VRING_NUM handling when configuring a virtual ring queue size larger than the device maximum. A local user can set a queue size exceeding the advertised maximum to read memory beyond the mapped descriptor ring.

2645) Out-of-bounds read (CVE-ID: CVE-2026-97995)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause an out-of-bounds read.

The vulnerability exists due to type confusion in the virtio_console remove_vqs() function when unbinding a device with a control message remaining on the control-out virtqueue. A local privileged user can unbind the device while the control message is queued to cause an out-of-bounds read.

2646) Race condition (CVE-ID: CVE-2026-97998)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the nfnetlink_log instance destruction handler when concurrently processing a netlink close event and an UNBIND request from sockets using the same port ID. A local user can trigger concurrent instance destruction and unbinding to cause a denial of service.

2647) Use-after-free (CVE-ID: CVE-2026-98006)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to a use-after-free in the ALSA caiaq USB driver's ep1_in_urb and midi_out_urb handling when processing a command timeout after a submitted URB is unlinked by the dummy HCD driver. A local user can trigger the affected initialization failure to trigger a use-after-free.

2648) Improper Validation of Specified Type of Input (CVE-ID: CVE-2026-98007)

CWE-ID: CWE-1287 - Improper Validation of Specified Type of Input

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper validation of helper argument types in the bpf_loop() nr_loops argument in the BPF verifier when a privileged BPF program passes a pointer value as the iteration count. A local privileged user can submit a privileged BPF program with a pointer-valued iteration count to trigger a verifier warning and kernel panic.

Exploitation requires a kernel configured with panic_on_warn enabled.

2649) NULL pointer dereference (CVE-ID: CVE-2026-98008)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the macb driver cleanup paths when unbinding the driver for a fixed-link device tree configuration without an "mdio" child node. A local privileged user can unbind the driver to cause a denial of service.

2650) Infinite loop (CVE-ID: CVE-2026-98009)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper validation of ETS quantum values in the ETS queuing discipline when configuring an ETS qdisc with crafted quantum values. A local user can configure a crafted ETS qdisc to cause a denial of service.

The issue requires CONFIG_NET_SCH_ETS and CAP_NET_ADMIN; namespace-local capabilities are sufficient.

2651) Resource exhaustion (CVE-ID: CVE-2026-98010)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper validation of DRR quantum values in drr_change_class() when configuring DRR qdisc classes with a low quantum value. A local user can configure a DRR qdisc class with the quantum set to 1 to cause a denial of service.

Exploitation requires CONFIG_NET_SCH_DRR=y and CAP_NET_ADMIN; the capability can be namespace-local through unshare -Urn.

2652) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-98011)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper validation of the quantum value in the HHF queueing discipline when configuring an HHF qdisc with quantum set to 1 and a crafted size table. A local user can configure the qdisc with these values to cause a deficit-refill loop to spin under the qdisc lock and cause a denial of service.

Exploitation requires CONFIG_NET_SCH_HHF=y and CAP_NET_ADMIN in a network namespace.

2653) Improper input validation (CVE-ID: CVE-2026-98012)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the SFQ qdisc change path when processing crafted qdisc configuration. A local user can configure a quantum value of 1 with a crafted size table to cause a denial of service.

The SFQ scheduler must be enabled, and exploitation requires CAP_NET_ADMIN, which can be namespace-local.

2654) Resource exhaustion (CVE-ID: CVE-2026-98013)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper validation of quantum values in fq_pie_change() when changing fq_pie qdisc configuration with a crafted size table. A local user can configure a quantum value of 1 and a crafted size table to cause a denial of service.

Exploitation requires CONFIG_NET_SCH_FQ_PIE to be enabled.

2655) Use-after-free (CVE-ID: CVE-2026-98014)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper cleanup ordering in the mlx5 E-Switch vport disable path when handling firmware-fatal recovery. A local user can trigger a PCI device reset to cause a denial of service.

2656) Use-after-free (CVE-ID: CVE-2026-98015)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access freed memory.

The vulnerability exists due to use-after-free in mlx5_eswitch_termtbl_put when two callers concurrently release the same mlx5_termtbl_handle. A local user can invoke concurrent calls on the same handle to access freed memory.

2657) Use-after-free (CVE-ID: CVE-2026-98016)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access freed memory.

The vulnerability exists due to a use-after-free race in sample_restore_put() when concurrently tearing down TC sample rules sharing the same restore context. A local user can concurrently tear down shared TC sample rules to access freed memory.

2658) Use-after-free (CVE-ID: CVE-2026-98017)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to a use-after-free in the Linux kernel traffic-control queueing discipline creation path when processing an RTM_NEWQDISC request with an invalid TCA_RATE attribute after binding a populated shared ingress block. A local user can send a crafted RTM_NEWQDISC request to cause memory corruption.

2659) Use-after-free (CVE-ID: CVE-2026-98018)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to a use-after-free in mctp_i3c_probe() when handling concurrent I3C bus removal notifications. A local user can trigger a race between device probing and bus removal to cause memory corruption.

2660) Race condition (CVE-ID: CVE-2026-98020)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in pds_core cmd_regs access handling when a function-level reset occurs concurrently with a devlink firmware update. A local user can trigger a function-level reset during a firmware update to cause a denial of service.

2661) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-98021)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause excessive memory allocation.

The vulnerability exists due to improper validation of a specified quantity in input in the IFLA_TXQLEN netlink attribute when processing netlink requests that specify a transmit queue length. A local user can submit a netlink request with an oversized tx_queue_len value to cause excessive memory allocation.

Exploitation requires network scheduling, veth, user namespace, and network namespace support.

2662) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-98022)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to allocation of resources without limits in netif_change_tx_queue_len() when processing tx queue length changes. A local user can set an oversized tx_queue_len value to cause a denial of service.

User and network namespaces must be enabled.

2663) Use-after-free (CVE-ID: CVE-2026-98023)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to use-after-free in the VXLAN forwarding database entry handling when configuring dynamic FDB entries that reference an FDB nexthop. A local user can configure dynamic entries on VXLAN devices that share an FDB nexthop to cause memory corruption.

The race can occur when an entry is aged while another device adds or deletes an entry associated with the shared FDB nexthop.

2664) Mismatched Memory Management Routines (CVE-ID: CVE-2026-98024)

CWE-ID: CWE-762 - Mismatched Memory Management Routines

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause slab allocator corruption.

The vulnerability exists due to incorrect memory deallocation in ism_alloc_dmb() when handling an error after allocating dmb->cpu_addr with folio_alloc(). A local user can trigger the error exit to cause slab allocator corruption.

The dmb->cpu_addr pointer may be used by future callers after the associated folio has been released.

2665) Heap-based buffer overflow (CVE-ID: CVE-2026-98025)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 0 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to corrupt memory.

The vulnerability exists due to a heap-based buffer overflow in the cx82310_rx_fixup function of the cx82310_eth USB network driver when processing a crafted USB network receive URB beginning with the 0xffff reboot sentinel. An attacker with physical access can send a crafted USB network receive URB to corrupt memory.

2666) Use-after-free (CVE-ID: CVE-2026-98026)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to improper RCU synchronization in the bridge multicast mglist when deleting port groups concurrently with adjacent multicast-list traversal. A local user can cause a port group to be freed while br_multicast_list_adjacent() traverses the mglist to trigger a use-after-free condition.

2667) Out-of-bounds write (CVE-ID: CVE-2026-98027)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or compromise confidentiality and integrity.

The vulnerability exists due to an out-of-bounds write in the mv88e6xxx_get_rxnfc() policy rule dump handler when processing an ETHTOOL_GRXCLSRLALL request with fewer caller-provided slots than policy rules. A local user can issue a request specifying an insufficient rule count to write beyond the allocated buffer.

Exploitation requires policy rules to have been installed for the targeted port.

2668) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-98028)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in the nfp_net_fs_add() rule replacement logic when reprogramming an existing rule after hardware programming fails. A local user can trigger a failed rule reprogramming operation to cause a denial of service.

The affected ethtool rule-list operation can subsequently return a permanent -EMSGSIZE error because the rule list and rule counter are not resynchronized.

2669) Out-of-bounds write (CVE-ID: CVE-2026-98029)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption or a denial of service.

The vulnerability exists due to missing bounds checking in nfp_net_get_fs_loc() when handling ETHTOOL_GRXCLSRLALL requests with a user-supplied rule count smaller than the number of flow steering rules. A local user can issue a crafted ioctl request to write rule locations beyond the caller-provided buffer.

Exploitation requires flow steering rules to have been installed; a rule count of zero leaves the rule-locations pointer NULL.

2670) Out-of-bounds write (CVE-ID: CVE-2026-98030)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to an out-of-bounds write in bcm_sf2_cfp_rule_get_all() in the Broadcom Starfighter 2 DSA driver when processing ETHTOOL_GRXCLSRLALL ioctl requests with a caller-supplied rule count. A local user can request fewer rule slots than installed CFP rules to compromise confidentiality, integrity, and availability.

Exploitation requires CFP rules to have already been installed.

2671) Access of Uninitialized Pointer (CVE-ID: CVE-2026-98031)

CWE-ID: CWE-824 - Access of Uninitialized Pointer

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to access of an uninitialized pointer in remove_nh_grp_entry() when replacing a reduced nexthop group after a listener allocation failure. A local user can trigger removal of a nexthop group entry to cause a denial of service.

2672) Untrusted Pointer Dereference (CVE-ID: CVE-2026-98037)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a NULL or stale-memory dereference.

The vulnerability exists due to improper validation of untrusted pointer state in the BPF verifier's type_is_ptr_alloc_obj() predicate when validating a refcount-only local kptr after RCU protection ends. A local user can pass a demoted local kptr to bpf_refcount_acquire() to trigger a NULL or stale-memory dereference.

Fault-protected reads of the demoted pointer remain valid.

2673) Type Confusion (CVE-ID: CVE-2026-98039)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform arbitrary kernel read and write operations.

The vulnerability exists due to improper type validation in map_kptr_match_type() when storing a non-per-CPU pointer in a BPF_KPTR_PERCPU map field. A local user can load a crafted BPF program that stores a plain allocation or referenced kernel pointer in the field to perform arbitrary kernel read and write operations.

2674) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-98041)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to incorrect branch prediction in the BPF verifier's is_branch_taken function when processing 32-bit BPF jump comparisons between pointers and zero. A local user can load a BPF program containing a 32-bit pointer-versus-zero comparison to compromise confidentiality, integrity, and availability.

2675) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-98046)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to install a file descriptor into an interrupted task.

The vulnerability exists due to improper execution-context validation in the bpf_btf_find_by_name_kind() helper prototype when invoking the helper from a non-sleepable BPF timer callback. A local user can invoke the helper from a BPF timer callback to install a file descriptor into an interrupted task.

2676) Incorrect calculation (CVE-ID: CVE-2026-98051)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to initiate a transmission without ensuring that consecutive descriptor slots are available.

The vulnerability exists due to incorrect loop initialization in tx_spb_ring_full() when checking descriptor slot availability for a new transmission. A local user can trigger a transmission after the function repeatedly checks the same descriptor slot instead of consecutive slots.

2677) Use-after-free (CVE-ID: CVE-2026-98052)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to use-after-free in the bcmasp_xmit() transmit descriptor handling when transmitting fragmented SKBs. A local user can transmit a fragmented SKB to cause a use-after-free condition.

The condition requires a descriptor slot to be reused with a stale final-fragment indicator while remaining SKB fragments are still in flight.

2678) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98054)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak a module reference.

The vulnerability exists due to missing module reference release on error paths in the ASoC Intel AVS strace_open debugfs handler when opening the strace debugfs file. A local user can trigger an error after a module reference is acquired to leak a module reference.

The issue is triggered if the trace FIFO is already initialized or its allocation fails.

2679) Memory leak (CVE-ID: CVE-2026-98055)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in the AVS PCI probe routine when fetching ML capabilities fails or subsequent probe initialization fails. A local user can trigger an AVS PCI device probe failure to cause a denial of service.

2680) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-98056)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient algorithmic complexity in nvme_scan_ns_list() when processing a reported NVMe namespace identifier list with sparse gaps. A remote attacker can provide a namespace list containing a large sparse namespace identifier gap to cause a denial of service.

2681) NULL pointer dereference (CVE-ID: CVE-2026-98063)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in btf_var_show() when bpf_snprintf_btf() renders a BTF_KIND_VAR from base vmlinux BTF. A local user can load and run a BPF program that passes the type ID of a BTF_KIND_VAR to bpf_snprintf_btf() to cause a denial of service.

2682) NULL pointer dereference (CVE-ID: CVE-2026-98064)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in btf_modifier_show() when processing a BPF program-supplied const void BTF type. A local user can supply a BPF program with a const void BTF type to bpf_snprintf_btf() to cause a denial of service.

2683) Double free (CVE-ID: CVE-2026-98066)

CWE-ID: CWE-415 - Double Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in the ALSA caiaq driver's audio resource cleanup when handling audio initialization errors. A local user can trigger an audio initialization error after URB resources have been freed to cause a denial of service.

2684) Race condition (CVE-ID: CVE-2026-98068)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a race condition in RDS TCP connection path shutdown handling when connection teardown races with acceptance of a new socket. A remote attacker can trigger concurrent connection teardown and socket acceptance to cause a denial of service.

The affected path can remain in RDS_CONN_DOWN with an established socket and a growing receive queue.

2685) Race condition (CVE-ID: CVE-2026-98069)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper synchronization in rds_conn_shutdown() in the RDS networking subsystem when tearing down an RDS connection path. A remote attacker can race transmission or receive-refill operations with connection teardown to cause a denial of service.

Exploitation occurs on weakly ordered architectures.

2686) Race condition (CVE-ID: CVE-2026-98070)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to a race condition in rds_tcp_reset_callbacks() in the RDS TCP transport when concurrent transmit and connection-reset operations access connection state. A remote attacker can trigger concurrent RDS transmission and connection-reset activity to compromise confidentiality, integrity, and availability.

2687) Race condition (CVE-ID: CVE-2026-98071)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause connection state updates to be lost.

The vulnerability exists due to a data race in rds_conn_path_reset() when resetting RDS connection path flags concurrently with atomic flag operations. A local user can trigger concurrent connection reset and transmission operations to cause connection state updates to be lost.

2688) Race condition (CVE-ID: CVE-2026-98072)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory ordering in release_in_xmit() in the RDS networking component when concurrently releasing transmit state and checking for waiters. A local user can trigger a race between waiter registration and transmit-state release to cause a denial of service.

A lost wake-up can leave shutdown workers waiting indefinitely in uninterruptible wait operations.

2689) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-98074)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to leave a physical device in promiscuous mode after bond teardown.

The vulnerability exists due to improper state management in __bond_release_one() when releasing all slaves during bond destruction. A local privileged user can destroy a bond containing active and backup slaves to leave a physical device in promiscuous mode after bond teardown.

The backup slave must be released before the active slave.

2690) Improper input validation (CVE-ID: CVE-2026-98075)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the BPF verifier when loading a BPF program that references the main program as a callback. A local user can load a crafted BPF program using a BPF_PSEUDO_FUNC reference to the main program to cause a denial of service.

2691) Use-after-free (CVE-ID: CVE-2026-98076)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to use-after-free in probe-based dynamic event field handling when looking up event fields after removing the first of several attached probes. A local user can create multiple probes for an event, remove the probe that defined its fields, and perform a field lookup to trigger a use-after-free.

2692) Out-of-bounds read (CVE-ID: CVE-2026-98077)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in sip_skip_whitespace() in nf_conntrack_sip when processing a SIP payload containing a recognized header name followed by whitespace at the end of the payload. A remote attacker can send such a crafted SIP payload to trigger an out-of-bounds read.

2693) Function Call with Incorrectly Specified Arguments (CVE-ID: CVE-2026-98078)

CWE-ID: CWE-628 - Function Call with Incorrectly Specified Arguments

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose stale heap data and corrupt connection sequence state.

The vulnerability exists due to incorrect function call argument ordering in the version 1 IPVS synchronization sender when serializing connection sequence data. A remote attacker can send traffic that causes connection sequence data to be synchronized to disclose stale heap data and corrupt connection sequence state.

Only connections with sequence-state flags set are affected.

2694) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-98080)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause filesystem metadata corruption and force the filesystem read-only.

The vulnerability exists due to improper reloc root creation in the Btrfs qgroup snapshot accounting path when accounting snapshots during block-group relocation. A local user can perform Btrfs operations that account snapshots during relocation to cause filesystem metadata corruption and force the filesystem read-only.

The issue occurs on Btrfs filesystems with quotas enabled.

2695) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-98081)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of exceptional conditions in the btrfs zoned block group cleanup logic when handling a zone-finish operation that fails. A local user can cause a zone-finish operation to fail to cause a denial of service.

2696) Memory leak (CVE-ID: CVE-2026-98082)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource cleanup in the Btrfs ordered extent bioc_list when handling ordered extents after errors. A local user can trigger an error while processing an ordered extent to cause a denial of service.

The leak can occur when RAID extent insertion fails or when an ordered extent encounters an I/O error.

2697) Use-after-free (CVE-ID: CVE-2026-98083)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to use-after-free in Btrfs RAID stripe insertion transaction handling when allocation of a RAID stripe extent fails. A local user can invoke the affected RAID stripe insertion path during this error condition to compromise confidentiality, integrity, and availability.

2698) NULL pointer dereference (CVE-ID: CVE-2026-98086)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the ALSA UMP legacy rawmidi name handling when a UMP packet arrives during endpoint initialization. A local user can trigger processing of a UMP packet during this initialization window to cause a denial of service.

2699) Out-of-bounds read (CVE-ID: CVE-2026-98088)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read.

The vulnerability exists due to improper handling of an invalid NUMA node value in _base_assign_reply_queues() when assigning high IOPS reply queues for a PCI device without NUMA-node affinity. A local user can trigger reply queue assignment to cause an out-of-bounds read.

The issue occurs when dev_to_node() returns NUMA_NO_NODE (-1).

2700) Out-of-bounds read (CVE-ID: CVE-2026-98089)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read out-of-bounds memory.

The vulnerability exists due to an uninitialized transport header offset causing an out-of-bounds read in alb_determine_nd() in the bonding driver when inspecting ICMPv6 headers in IPv6 packets on bonding transmit paths. A remote attacker can send an IPv6 packet that is processed through a bonding transmit path to read out-of-bounds memory.

The affected paths include packets sent through AF_PACKET or raw sockets and forwarded packets.

2701) Use-after-free (CVE-ID: CVE-2026-98090)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Btrfs active device pointers when handling a failed sprout setup. A local user can trigger a failed sprout setup to cause a denial of service.

2702) Use-after-free (CVE-ID: CVE-2026-98091)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a kernel warning.

The vulnerability exists due to use-after-free in the btrfs device transaction update list when system chunk creation fails while creating the first metadata chunk for a sprout filesystem. A local user can create a sprout filesystem that encounters a system chunk creation failure to cause a kernel warning.

2703) Memory leak (CVE-ID: CVE-2026-98092)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory release in acp6x_pdm_dma_close() when closing PDM DMA audio streams. A local user can repeatedly open and close PDM DMA audio streams to cause a denial of service.

2704) Deadlock (CVE-ID: CVE-2026-98094)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an IRQ-unsafe locking mechanism in the fbtft dirty_lock handling in fbtft_mkdirty() and fbtft_deferred_io() when framebuffer console rendering occurs in hardirq context concurrently with deferred I/O workqueue processing. A local user can trigger concurrent framebuffer console rendering and deferred I/O processing to cause a denial of service.

2705) Incorrect Conversion between Numeric Types (CVE-ID: CVE-2026-98095)

CWE-ID: CWE-681 - Incorrect Conversion between Numeric Types

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper numeric type conversion in tpacket_parse_header() in af_packet when processing a user-provided tpacket_hdr with tp_len larger than INT_MAX. A local user can provide a crafted packet header to cause a denial of service.

2706) Out-of-bounds write (CVE-ID: CVE-2026-98096)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption or a denial of service.

The vulnerability exists due to improper network header offset restoration in the Linux kernel ipv6_srh_rcv() function when processing IPv6 Segment Routing Header packets preceded by another extension header. A remote attacker can send a specially crafted IPv6 packet to cause memory corruption or a denial of service.

2707) Use of uninitialized resource (CVE-ID: CVE-2026-98097)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to use of uninitialized memory in TIPC link protocol message construction when sending RESET or ACTIVATE messages. A remote attacker can receive RESET or ACTIVATE messages containing random pad bytes to disclose sensitive information.

2708) NULL pointer dereference (CVE-ID: CVE-2026-98098)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in tipc_named_node_up() when processing node state publications after the local publication limit is reached. A local user can bind a large number of local-scope service addresses to sockets to cause a denial of service.

Subscribers to node or link up/down events may stop receiving notifications.

2709) Race condition (CVE-ID: CVE-2026-98101)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause IPv6 multicast packets to be evaluated against incorrect source filters.

The vulnerability exists due to a race condition in the ip6_mc_source() IPv6 multicast source-filter handling function when source filters are modified concurrently with packet reception. A local user can concurrently add or remove IPv6 multicast source filters to cause IPv6 multicast packets to be evaluated against incorrect source filters.

The race affects UDP and raw multicast receive paths.

2710) Race condition (CVE-ID: CVE-2026-98102)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect IPv6 multicast source filtering.

The vulnerability exists due to improper synchronization in ip6_mc_del1_src() when removing active IPv6 multicast source filters concurrently with RCU-protected list traversal. A local user can trigger concurrent source-filter removal and list traversal to cause incorrect IPv6 multicast source filtering.

2711) Deadlock (CVE-ID: CVE-2026-98103)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to recursive locking in ip_check_mc_rcu() when generating IGMPv3 reports while an XFRM policy matches a multicast destination. A local user can trigger IGMPv3 report generation to cause a denial of service.

The affected function is used in packet receive and route lookup RCU fast paths.

2712) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-98104)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to access and modify u32 knodes associated with another tcf_proto instance.

The vulnerability exists due to improper handling of identifier-pool exhaustion in gen_new_htid and u32_init when creating a root hash table after the tp_c handle pool is exhausted. A local privileged user can exhaust the tp_c handle pool and create another u32 proto entry to cause root hash table handle aliasing.

The affected classifier must be enabled.

2713) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-98104)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause duplicate u32 filter handles.

The vulnerability exists due to improper handling of identifier-pool exhaustion in gen_new_kid and u32_change when generating automatic u32 node handles after the node ID pool is exhausted. A local privileged user can add enough u32 filters with automatically generated handles to exhaust the node ID space and cause duplicate handles.

The affected classifier must be enabled and a clsact qdisc must be configured on a device.

2714) Out-of-bounds write (CVE-ID: CVE-2026-98107)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds write.

The vulnerability exists due to an out-of-bounds write in the L2CAP ECRED connection handling when connecting a sequence of L2CAP sockets with deferred and non-deferred channels. A local user can initiate the socket connection sequence to write a 16-bit SCID value past the SCID array.

2715) Stack-based buffer overflow (CVE-ID: CVE-2026-98108)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 7.7 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to a stack-based buffer overflow in the Bluetooth L2CAP deferred enhanced credit-based response handling when processing L2CAP LE connection requests. A remote attacker can send specially crafted L2CAP LE connection requests to cause memory corruption.

The issue involves deferred-setup channels and listening parent channels configured for extended flow control.

2716) Race condition (CVE-ID: CVE-2026-98109)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel DEBUG_LOCKS warning.

The vulnerability exists due to a race condition in Bluetooth HCI device registration and Microsoft extension initialization when registering a Bluetooth device marked with an unconfigured-device quirk. A local user can trigger concurrent power-on work processing before the Microsoft extension mutex is initialized to trigger a kernel DEBUG_LOCKS warning.

2717) Out-of-bounds read (CVE-ID: CVE-2026-98111)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read out-of-bounds memory.

The vulnerability exists due to insufficient length validation in btintel_parse_version_tlv() when parsing Bluetooth version TLV responses. A local user can provide a TLV with a value shorter than required for its type to read out-of-bounds memory.

2718) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-98113)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to flood the kernel log.

The vulnerability exists due to missing rate limiting in the ksmbd DACL SID mapping error logging path when processing a DACL containing unmapped SIDs. A remote user can submit a DACL with many structurally valid but unmapped SIDs to flood the kernel log.

2719) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-98114)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incomplete ACL conversion.

The vulnerability exists due to improper error handling in the ksmbd parse_dacl() function when parsing malformed SMB security descriptors. A remote attacker can submit a malformed security descriptor to cause incomplete ACL conversion.

2720) Use-after-free (CVE-ID: CVE-2026-98116)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to a use-after-free in ALSA PCM mmap handling when concurrently mapping PCM data during buffer reallocation. A local user can race an mmap operation against buffer reallocation to obtain a stale writable mapping of freed pages and escalate privileges.

2721) NULL pointer dereference (CVE-ID: CVE-2026-98121)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the msc313e watchdog driver's power management callbacks when handling system suspend or resume operations. A local user can trigger the power management callbacks to cause a denial of service.

2722) Use-after-free (CVE-ID: CVE-2026-98122)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to a use-after-free in vxlan_mdb_remote_src_del() when processing VXLAN MDB updates containing an all-zeros source address. A local user can submit crafted VXLAN MDB entries to compromise confidentiality, integrity, and availability.

MDB operations are network-namespace scoped and can be performed in a new user and network namespace.

2723) Out-of-bounds read (CVE-ID: CVE-2026-98123)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to read memory out of bounds.

The vulnerability exists due to an out-of-bounds read in sctp_get_asconf_response() when processing a truncated SCTP_PARAM_ERR_CAUSE parameter in an ASCONF-ACK. A remote user can send a crafted ASCONF-ACK containing an error-cause parameter without a complete error header to read memory out of bounds.

The association must have ADD-IP enabled and an outstanding ASCONF request.

2724) Infinite loop (CVE-ID: CVE-2026-98123)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper parameter iteration in sctp_get_asconf_response() when processing a crafted ASCONF-ACK. A remote user can send an ASCONF-ACK containing an odd-length parameter that causes the parameter-processing loop to make no progress and spin in softirq context to cause a denial of service.

The association must have ADD-IP enabled and an outstanding ASCONF request.

2725) Improper Authorization (CVE-ID: CVE-2026-98126)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass file-size limits.

The vulnerability exists due to missing file-size limit validation in smb3_zero_range() when using FALLOC_FL_ZERO_RANGE without FALLOC_FL_KEEP_SIZE on a file on a CIFS mount. A local user can invoke a zero-range operation that extends the end of the file to bypass file-size limits.

2726) Improper input validation (CVE-ID: CVE-2026-98127)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass file-size limits.

The vulnerability exists due to improper validation of the calculated end-of-file size in smb3_insert_range() when handling FALLOC_FL_INSERT_RANGE requests on a CIFS mount. A local user can invoke fallocate with FALLOC_FL_INSERT_RANGE to bypass file-size limits.

2727) Memory leak (CVE-ID: CVE-2026-98128)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a missing reference release in mpi3mr_sas_port_add() when handling an error after acquiring a target device reference. A local user can trigger the error path after a target device reference is acquired to cause a denial of service.

The target device reference is acquired only for SAS_END_DEVICE types.

2728) Memory leak (CVE-ID: CVE-2026-98129)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak memory.

The vulnerability exists due to improper resource release in mpi3mr_sas_port_add() when adding an allocated SAS port fails. A local user can trigger SAS port addition failures to leak memory.

2729) NULL pointer dereference (CVE-ID: CVE-2026-98129)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in mpi3mr_sas_port_add() when allocating a SAS port. A local user can trigger SAS port addition when memory allocation fails to cause a denial of service.

2730) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-98130)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a use-after-free.

The vulnerability exists due to a time-of-check to time-of-use race condition in the SCTP_CMD_TIMER_START handler when processing SCTP timer start commands. A remote attacker can trigger the race condition to trigger a use-after-free.

2731) Out-of-bounds write (CVE-ID: CVE-2026-98142)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the cirrus-qemu driver's VRAM handling when updating a display plane for a PCI device with an undersized BAR0. A local user can cause a PCI device with a BAR0 smaller than the expected VRAM size to be bound to the driver to cause a denial of service.

2732) Incorrect calculation (CVE-ID: CVE-2026-98151)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a verifier warning.

The vulnerability exists due to inconsistent synchronization of 32-bit register bounds and pointer offset state in the BPF verifier when verifying speculative pointer arithmetic in an unprivileged BPF program. A local user can load a BPF program that performs bounded scalar arithmetic on a map-value pointer to trigger a verifier warning.

The warning occurs when the verifier evaluates a subsequent register copy along a speculative path.

2733) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-98154)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to improper cleanup of completed requests in the nvme_rdma_queue_rq function when handling an -EIO error in the NVMe RDMA queue request path. A local user can trigger an -EIO error during queue request processing to compromise confidentiality, integrity, and availability.

2734) Out-of-bounds read (CVE-ID: CVE-2026-98155)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the QAIC response worker when processing a malformed wire message from the device. A local user can send a malformed wire message from the device to cause a denial of service.

2735) Numeric Truncation Error (CVE-ID: CVE-2026-98157)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to numeric truncation and insufficient input validation in the poll_msec sysfs store handler when processing user-supplied polling-delay values. A local user can write a zero value or an oversized value that truncates to zero to cause a denial of service.

2736) Out-of-bounds write (CVE-ID: CVE-2026-98158)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of skb headroom in ppp_async's process_input_packet() when processing a bad-FCS PPP frame followed by a crafted frame. A remote attacker can send malformed PPP frames to cause a denial of service.

When CCP compression is enabled, decompression can read before the skb head.

2737) Out-of-bounds write (CVE-ID: CVE-2026-98159)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to improper bounds checking in the mt7921_load_clc CLC firmware record loader when processing a malformed CLC firmware image. A local user can provide a malformed CLC firmware image to cause memory corruption.

2738) Mismatched Memory Management Routines (CVE-ID: CVE-2026-98160)

CWE-ID: CWE-762 - Mismatched Memory Management Routines

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to mismatched memory management routines in rtw_sdio_if1_init() when handling an initialization failure after allocating HalData. A local user can trigger the initialization error path to cause memory corruption.

2739) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-98161)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause data writes to complete despite a failed ordering barrier.

The vulnerability exists due to improper handling of flush errors in pmem_submit_bio() when processing bio requests with REQ_PREFLUSH and REQ_FUA flags. A local user can submit a bio request with these flags after a preflush failure to cause data writes to complete despite a failed ordering barrier.

2740) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-98164)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect control flow implementation in the KVM x86 MMU page-tracking logic when checking write tracking across address spaces. A local user can cause a write-tracked guest frame number to be treated as untracked and trigger a kernel BUG to cause a denial of service.

The issue occurs when system management mode uses multiple address spaces.

2741) Out-of-bounds read (CVE-ID: CVE-2026-98167)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger out-of-bounds reads.

The vulnerability exists due to incorrect sub-PDU length validation in the Linux kernel SMB client when processing compound encrypted SMB frames. A remote attacker can send a compound encrypted frame containing a truncated non-last sub-PDU to trigger out-of-bounds reads.

2742) Out-of-bounds read (CVE-ID: CVE-2026-98168)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger out-of-bounds reads.

The vulnerability exists due to insufficient bounds checking in cifs_query_reparse_point() when processing an SMB server response containing reparse point data. A remote attacker can send a crafted response with a DataOffset that leaves fewer than eight bytes available for the reparse_data_buffer header to trigger out-of-bounds reads.

The affected reads access the ReparseTag and ReparseDataLength fields.

2743) Out-of-bounds read (CVE-ID: CVE-2026-98169)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose kernel memory to userspace.

The vulnerability exists due to an out-of-bounds read in smb3_enum_snapshots() in the Linux kernel SMB client when processing short server replies during snapshot enumeration. A remote attacker can supply a specially crafted SMB ioctl reply to disclose kernel memory to userspace.

The vulnerable path is reached when snapshot_array_size is smaller than GMT_TOKEN_SIZE. The exposed data comes from slab memory adjacent to the reply buffer.

2744) Out-of-bounds read (CVE-ID: CVE-2026-98170)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger out-of-bounds reads.

The vulnerability exists due to insufficient bounds checking in move_smb2_ea_to_cifs() when processing a malformed extended attribute list returned by an SMB server. A remote attacker can return a specially crafted extended attribute list containing a truncated smb2_ea_info structure to trigger out-of-bounds reads.

The affected reads access the ea_name_length and ea_value_length fields.

2745) Integer overflow (CVE-ID: CVE-2026-98171)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass command offset bounds checks.

The vulnerability exists due to integer overflow in the SMB client's receive_encrypted_standard() function when checking upper bounds for command offsets in compound encrypted frames. A remote attacker can supply a frame with a NextCommand value that triggers overflow in the upper-bound calculation to bypass command offset bounds checks.

The bounds check is intended to ensure that the trailing slice is large enough to contain a header.

2746) Improper Validation of Specified Index, Position, or Offset in Input (CVE-ID: CVE-2026-98171)

CWE-ID: CWE-1285 - Improper Validation of Specified Index, Position, or Offset in Input

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause acceptance of command offsets below the minimum header size.

The vulnerability exists due to insufficient command offset validation in the SMB client's receive_encrypted_standard() function when handling compound encrypted frames. A remote attacker can supply a frame with a nonzero NextCommand value smaller than MID_HEADER_SIZE(server) to cause acceptance of command offsets below the minimum header size.

2747) Improper Handling of Length Parameter Inconsistency (CVE-ID: CVE-2026-98171)

CWE-ID: CWE-130 - Improper Handling of Length Parameter Inconsistency

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause command offsets to reference stale ciphertext residue.

The vulnerability exists due to incorrect plaintext length tracking in the SMB client's receive_encrypted_standard() function when validating command offsets in compound encrypted frames. A remote attacker can supply a frame with a NextCommand offset beyond the decrypted plaintext size but within the pre-decryption length to cause command offsets to reference stale ciphertext residue.

2748) Use-after-free (CVE-ID: CVE-2026-98171)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger access to freed memory.

The vulnerability exists due to use-after-free in the SMB client's receive_encrypted_standard() function when handling compound encrypted frames and subsequent error paths. A remote attacker can supply compound encrypted frames that encounter an error after buffer reassignment to trigger access to freed memory.

The next_buffer pointer remains stale after its buffer is assigned to server->bigbuf.

2749) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98172)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an RDMA connection resource leak.

The vulnerability exists due to missing release of an established RDMA connection in the Linux kernel SMB client's cifs_get_tcp_session() function when session setup fails after smbd_get_connection() successfully establishes the connection. A local user can trigger this error path to cause an RDMA connection resource leak.

The session setup failure can occur when kthread_create() returns an error.

2750) Use-after-free (CVE-ID: CVE-2026-98173)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger accesses to freed kernel memory.

The vulnerability exists due to use-after-free in cifs_try_adding_channels() when adding SMB channels concurrently with a server interface refresh. A local user can trigger overlapping channel addition and interface refresh operations to trigger accesses to freed kernel memory.

2751) Race condition (CVE-ID: CVE-2026-98174)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in cifs_signal_cifsd_for_reconnect() when multiple cifsd threads process reconnections concurrently. A local user can trigger concurrent reconnection processing that adds the same server's rlist node twice to a local list, corrupting it, to cause a denial of service.

2752) Improper initialization (CVE-ID: CVE-2026-98174)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in the SMB client's TCP_Server_Info.rlist when adding a server node to the reconnection list. A local user can trigger reconnection processing involving an improperly initialized node to cause a denial of service.

The zero-initialized list pointers cause list_empty() to return false and list_add() to dereference a NULL prev pointer.

2753) Use-after-free (CVE-ID: CVE-2026-98175)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the SMB client clean_demultiplex_info() function when the demultiplex thread exits while server reconnect work remains queued. A local user can trigger this cleanup sequence to cause a denial of service.

The queued smb2_reconnect_server() work subsequently reads the srv_count field of the freed server structure.

2754) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98179)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to consume kernel mapping resources.

The vulnerability exists due to failure to release register BAR mappings in amdgpu_device_fini_sw() when removing a device or unloading the driver. A local privileged user can trigger driver unloading, leaking one register BAR mapping per unload, to consume kernel mapping resources.

2755) Out-of-bounds write (CVE-ID: CVE-2026-98181)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to write beyond the bounds of an allocated properties array.

The vulnerability exists due to incorrect indexing that causes an out-of-bounds write in the GUD plane property loop when processing properties advertised by a USB device. An attacker with physical access can advertise the maximum number of properties through a USB device to write beyond the bounds of an allocated properties array.

2756) NULL pointer dereference (CVE-ID: CVE-2026-98182)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in mac80211 monitor-interface handling and the ath9k driver when activating a monitor interface without a transmit queue. A local privileged user can set the active flag on a down monitor interface and then bring the interface up to cause a denial of service.

Exploitation requires the CAP_NET_ADMIN capability. The RTNL lock remains held, causing subsequent netlink operations to block.

2757) Integer underflow (CVE-ID: CVE-2026-98185)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger out-of-bounds reads.

The vulnerability exists due to integer underflow in mwifiex_ret_802_11_scan() when processing firmware-provided scan responses. A local user can supply a short response or a response with an oversized BSS length to trigger out-of-bounds reads.

The affected processing handles both normal and background scan responses.

2758) Out-of-bounds read (CVE-ID: CVE-2026-98186)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read beyond the bounds of a kernel beacon buffer.

The vulnerability exists due to an out-of-bounds read in mwifiex_search_oui_in_ie() when processing RSN or WPA information elements in beacon or probe-response frames during scan-result parsing. A remote attacker can transmit a crafted information element with a pairwise-cipher count exceeding the element's available length to read beyond the bounds of a kernel beacon buffer.

2759) Out-of-bounds read (CVE-ID: CVE-2026-98187)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the p54_parse_eeprom() function when parsing a truncated trailing record in a PDR_INTERFACE_LIST entry. A local user can provide a malformed EEPROM buffer to disclose sensitive information.

The variant value read from the record also feeds synth front-end selection.

2760) Out-of-bounds read (CVE-ID: CVE-2026-98188)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause out-of-bounds reads past the EEPROM buffer.

The vulnerability exists due to an out-of-bounds read in p54_convert_rev0() and p54_convert_rev1() when processing device-supplied EEPROM calibration curve entries with channel and points-per-channel counts that exceed the available entry data. A local user can supply an EEPROM entry declaring more calibration curve data than it contains to cause out-of-bounds reads past the EEPROM buffer.

Exploitation requires control over the device-supplied EEPROM entry.

2761) Out-of-bounds write (CVE-ID: CVE-2026-98189)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to corrupt neighboring kernel memory.

The vulnerability exists due to an out-of-bounds write in wilc_wlan_handle_isr_ext() in the wilc1000 wireless driver when processing receive transfers whose device-reported size exceeds the receive buffer capacity. An attacker with physical access can supply an oversized transfer containing controlled data through a bogus SDIO device to corrupt neighboring kernel memory.

The receive buffer is 96 KiB, while the device-reported transfer size can reach 131068 bytes. An oversized transfer can also leave the buffer offset beyond its end, allowing subsequent overflows to repeat.

2762) Out-of-bounds read (CVE-ID: CVE-2026-98190)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the wilc1000 driver's wilc_wfi_p2p_rx() and mgmt_tx() functions when processing public action frames shorter than the 32-byte P2P public action header. A remote attacker can transmit a specially crafted 25- to 31-byte public action frame over the air to cause a denial of service.

Exploitation through the receive path requires the host to be in P2P listen mode. No wireless association is required.

2763) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98191)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a runtime power-management reference leak.

The vulnerability exists due to failure to release a runtime power-management reference in wlcore_regdomain_config() when handling a failed regulatory-domain command. A local user can trigger a regulatory-domain command failure to cause a runtime power-management reference leak.

The recovery worker acquires a separate runtime power-management reference and cannot release the reference held by this function.

2764) Use-after-free (CVE-ID: CVE-2026-98192)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free in kernel memory.

The vulnerability exists due to use-after-free in the wcn36xx wireless driver's TX ack timer teardown when removing the device while a timer callback is still executing. A local user can trigger teardown concurrently with the callback to cause a use-after-free in kernel memory.

2765) Out-of-bounds read (CVE-ID: CVE-2026-98193)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger an out-of-bounds read.

The vulnerability exists due to an unsigned payload length wraparound in libipw_michael_mic_verify() when processing short TKIP frames without a complete eight-byte Michael MIC. A remote attacker can send a short TKIP frame to trigger an out-of-bounds read in michael_mic() beyond the socket buffer.

The TKIP key must be set for the vulnerable verification path to run.

2766) Use-after-free (CVE-ID: CVE-2026-98194)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause the kernel to dereference freed memory.

The vulnerability exists due to use-after-free in lbtf_free_adapter() in the libertas_tf wireless driver when freeing command buffers while the command timer callback is still running. A local user can cause adapter cleanup to overlap with an active command timer callback to cause the kernel to dereference freed memory.

The command_timer_fn callback accesses priv->cur_cmd->cmdbuf.

2767) Double free (CVE-ID: CVE-2026-98195)

CWE-ID: CWE-415 - Double Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in the iwlegacy driver's broadcast station deallocation when handling an error during driver startup. A local user can toggle RF_KILL during driver startup to cause a denial of service.

2768) Use-after-free (CVE-ID: CVE-2026-98196)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause access to freed kernel memory.

The vulnerability exists due to use-after-free in the brcmsmac driver's brcms_free_timer() function when freeing a timer while its delayed-work callback is still running. A local user can trigger this overlapping timer cleanup and callback execution to cause access to freed kernel memory.

The non-synchronous cancel_delayed_work() call returns without waiting for an already-running callback, which accesses the timer structure through container_of().

2769) Use-after-free (CVE-ID: CVE-2026-98197)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger accesses to freed driver data.

The vulnerability exists due to use-after-free in the w83791d driver's fan/pwm 4-5 sysfs callbacks when accessing leftover sysfs files after driver unbind. A local user can access these leftover files to trigger accesses to freed driver data.

The optional sysfs group is created only when the fan/pwm 4-5 pins are not used as GPIO.

2770) Use-after-free (CVE-ID: CVE-2026-98198)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to use-after-free in the pwm-fan driver's sample_timer() callback when detaching the driver while the RPM timer is active. A local user can trigger driver detachment during a timer expiry window to corrupt kernel memory.

The callback accesses device-managed tachometer arrays that can be freed before timer cleanup occurs. The callback can also rearm the RPM timer.

2771) Out-of-bounds write (CVE-ID: CVE-2026-98199)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to out-of-bounds writes in the PMBus core when probing chips with more than 10 phases per page. A local user can trigger probing of an affected chip to corrupt kernel memory.

The mp2975 driver supports up to 14 phases per page, and the mp2856 driver supports up to 12 phases per page.

2772) Use-after-free (CVE-ID: CVE-2026-98200)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read freed kernel memory.

The vulnerability exists due to use-after-free in fungible_show() in the hp-wmi-sensors driver when reading a sensor's current_state debugfs entry concurrently with a sensor state update that replaces the current_state string. A local user can trigger overlapping reads of the same sensor to read freed kernel memory.

2773) Use of Uninitialized Variable (CVE-ID: CVE-2026-98201)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose kernel stack memory.

The vulnerability exists due to use of an uninitialized stack variable in input_ff_effect_from_user() when copying a smaller compatibility structure into the native struct ff_effect. A local user can submit a force feedback effect through EVIOCSFF and retrieve the stored native structure through UI_BEGIN_FF_UPLOAD to disclose kernel stack memory.

The readback path requires a uinput-based force feedback daemon.

2774) NULL pointer dereference (CVE-ID: CVE-2026-98202)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the synaptics-rmi4 driver's rmi_driver_suspend() and rmi_driver_resume() functions when handling system power management events for an unbound RMI device. A local user can trigger system suspend or resume to cause a denial of service.

2775) Out-of-bounds read (CVE-ID: CVE-2026-98203)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in soc_button_get_button_info() in drivers/input/misc/soc_button_array.c when processing an empty ACPI button descriptor package. A local user can trigger access to btns_desc->package.elements[0] with a zero package count to trigger an out-of-bounds read.

2776) Out-of-bounds read (CVE-ID: CVE-2026-98204)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read.

The vulnerability exists due to incorrect block-length calculation in rmi_smb_write_block() when splitting writes into SMBus blocks. A local user can trigger a write with an input length greater than 32 bytes and a partial final block to cause an out-of-bounds read.

The final partial block causes smb_block_write() to read 32 bytes even when fewer bytes remain in the input buffer.

2777) Use of Uninitialized Variable (CVE-ID: CVE-2026-98205)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of an uninitialized stack variable in the evdev_do_ioctl() function when processing EVIOCSABS ioctl requests with user-supplied sizes. A local user can submit an EVIOCSABS request with a short size and retrieve the resulting absolute axis information through EVIOCGABS to disclose sensitive information.

The disclosed data consists of stale kernel stack bytes left in the portion of the input_absinfo structure not supplied by the caller.

2778) Out-of-bounds write (CVE-ID: CVE-2026-98206)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to an out-of-bounds write in the cyttsp5 touchscreen driver's cyttsp5_handle_irq() function when handling device-supplied HID reports. A local user can provide a report with a size field exceeding the response buffer capacity to corrupt kernel memory.

2779) Incorrect calculation (CVE-ID: CVE-2026-98207)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause transfer completion accounting to report incorrect byte counts.

The vulnerability exists due to failure to reset the transferred-byte counter in mmc_spi_request() when retrying a multi-block request after a data CRC error. A local user can issue a multi-block transfer request that encounters a CRC error followed by a successful internal retry to cause transfer completion accounting to report incorrect byte counts.

The data itself is retried. Exploitation depends on an MMC-over-SPI system encountering a data CRC error during the transfer.

2780) Memory leak (CVE-ID: CVE-2026-98208)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to consume kernel memory through a transmit FIFO leak.

The vulnerability exists due to failure to release allocated memory in sdio_uart_add_port() when attempting to add a port after all UART_NR slots in sdio_uart_table[] are occupied. A local user can trigger a port-addition attempt with a full port table to consume kernel memory through a transmit FIFO leak.

2781) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-98209)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leave SDHCI child devices registered after their parent resources have been released.

The vulnerability exists due to improper resource lifecycle management in the Aspeed SDHCI controller driver when probe failure or device removal occurs. A local user can trigger these lifecycle paths to leave SDHCI child devices registered after their parent resources have been released.

The released parent resources include the controller clock and managed resources.

2782) Use-after-free (CVE-ID: CVE-2026-98210)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger access to freed host memory.

The vulnerability exists due to use-after-free in the mxcmmc driver's asynchronous callbacks when removing the driver without draining pending work and the watchdog timer. A local user can trigger driver removal while asynchronous callbacks remain pending to trigger access to freed host memory.

The watchdog is armed on the DMA path with a 10-second timeout. The datawork callback is scheduled by the IRQ handler on the PIO path.

2783) Use-after-free (CVE-ID: CVE-2026-98212)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger access to freed kernel memory.

The vulnerability exists due to use-after-free in the MMC host software queue retry work handler when processing pending retry work after driver removal. A local user can trigger execution of pending retry work after its associated allocation has been released to trigger access to freed kernel memory.

Retry work is queued when request_atomic() returns -EBUSY. The sdhci-sprd driver is the only identified consumer implementing request_atomic().

2784) Use-after-free (CVE-ID: CVE-2026-98213)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free access to kernel memory.

The vulnerability exists due to use-after-free in the MMC core SDIO interrupt worker when pending interrupt work executes after the host controller is removed and its host structure is freed. A local user can trigger execution of the pending worker during this removal race to cause a use-after-free access to kernel memory.

The issue applies to host controllers that use sdio_signal_irq() to schedule SDIO interrupt work from their interrupt handlers.

2785) Function Call with Incorrectly Specified Arguments (CVE-ID: CVE-2026-98216)

CWE-ID: CWE-628 - Function Call with Incorrectly Specified Arguments

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrectly specified DMA mapping arguments in the PIO_CRED case of hfi1_file_mmap() when selecting a credit-return page with an offset buffer address and a zero page offset. A local user can map the wrong credit-return page and initiate transfers using send PIO to cause a denial of service.

For an IOMMU-backed, virtually mapped allocation, the issue affects contexts whose credit-return entries reside on the second or third page. Transfers using send PIO stall indefinitely, while send-DMA-only transfers remain operational.

2786) Incorrect Pointer Scaling (CVE-ID: CVE-2026-98216)

CWE-ID: CWE-468 - Incorrect Pointer Scaling

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect pointer scaling in the PIO_CRED case of hfi1_file_mmap() when mapping a credit-return page using a byte offset added to a struct credit_return pointer. A local user can map and read the affected credit-return page to cause a denial of service.

The erroneous offset occurs when the hardware send context index reaches 64 or 128. With IOMMU translation, the resulting mapping installs an invalid page-table entry, and the first user-space read triggers a kernel Oops.

2787) Use-after-free (CVE-ID: CVE-2026-98217)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free during device cleanup.

The vulnerability exists due to use-after-free in the mlx4 InfiniBand driver's pkey sysfs cleanup when cleaning up a device after a per-slave pkey sysfs registration failure. A local user can trigger cleanup of a failed slave tree with stale parent kobject pointers to trigger a use-after-free.

Registration continues for the remaining slaves despite per-slave registration errors.

2788) Use-after-free (CVE-ID: CVE-2026-98218)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to prevent reuse of an I2C adapter channel.

The vulnerability exists due to use-after-free in the I2C address translator adapter management code when handling cleanup after an adapter registration failure. A local user can trigger an adapter registration failure that leaves a dangling channel pointer to prevent reuse of an I2C adapter channel.

2789) Out-of-bounds read (CVE-ID: CVE-2026-98221)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause out-of-bounds memory reads.

The vulnerability exists due to incorrect bounds checking in tpm2_load_cmd() when loading an ASN.1-encoded TPM 2.0 trusted key blob. A local user can supply a crafted trusted key blob to cause out-of-bounds memory reads.

The boundary checks use the ASN.1-encoded payload size rather than the decoded blob size.

2790) Integer overflow (CVE-ID: CVE-2026-98222)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write beyond an allocated kernel heap buffer.

The vulnerability exists due to integer overflow in encrypted_key_alloc() when calculating encrypted key payload lengths. A local user can supply key data whose combined lengths exceed the 16-bit allocation size limit to write beyond an allocated kernel heap buffer.

2791) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98227)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to failure to release allocated workqueue resources in the Linux kernel Memory Stick block driver when removing a memory card. An attacker with physical access can repeatedly insert and remove a memory card to cause a denial of service.

Each insertion and removal cycle leaks the per-card workqueue and its worker thread, progressively exhausting kernel memory.

2792) Use-after-free (CVE-ID: CVE-2026-98229)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause the kernel to dereference freed memory.

The vulnerability exists due to use-after-free in xfrm_input() when receive-side processing resets the packet's security path before the function finishes accessing the associated XFRM state. A remote attacker can send packets processed during concurrent deletion of the associated state to cause the kernel to dereference freed memory.

The race requires secpath_reset() to release the last state reference. Relevant paths include VTI receive processing, cross-network-namespace packets on XFRM interfaces, and the XFRM_MAX_DEPTH error path.

2793) Use-after-free (CVE-ID: CVE-2026-98230)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to use-after-free in the xfrm state_cache and state_cache_input lists in net/xfrm/xfrm_state.c when deleting the same xfrm state more than once. A local user can trigger repeated deletion of the same state to corrupt kernel memory.

The write use-after-free occurs once the slab is reused. Subsequent list traversal can encounter a dangling next pointer, causing a read use-after-free in xfrm_input_state_lookup().

2794) Use-after-free (CVE-ID: CVE-2026-98231)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in xfrm_dev_state_free() when deferred device state flushing races with state garbage collection. A local user can trigger concurrent device state flushing and state garbage collection to cause a denial of service.

The device garbage collection list does not hold an xfrm_state reference. Both execution paths can invoke the driver callback and release the device reference.

2795) Out-of-bounds write (CVE-ID: CVE-2026-98232)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.4 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to execute arbitrary code and disclose sensitive information.

The vulnerability exists due to out-of-bounds reads and writes in scsi_cdl_enable() in drivers/scsi/scsi.c when processing target-supplied MODE SENSE length fields. An attacker with physical access can supply crafted MODE SENSE responses through a USB storage device that identifies as an ATA device and advertises CDL support to execute arbitrary code and disclose sensitive information.

Exploitation is reachable during automatic device scanning without a filesystem mount or userspace access to the block device. Code execution was demonstrated using a build-specific, one-vCPU QEMU/Raw Gadget proof with QEMU-only multi-UDC allocator sampling, while KASLR and NX were enabled.

2796) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98233)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service in packet ring reception.

The vulnerability exists due to failure to release ring slot ownership in tpacket_rcv() when virtio-net header conversion fails for an unsupported UDP GSO packet. A local user can send an unsupported UDP GSO packet to cause a denial of service in packet ring reception.

With a one-frame TPACKET_V2 ring, the only slot becomes unavailable and the next valid packet is dropped. TPACKET_V3 is not affected by this error path.

2797) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-98234)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to allocation of resources without limits in the heavy-hitter filter (HHF) queuing discipline when processing heavy-hitter flows with an excessively large configured flow limit. A local user can configure an oversized hh_limit and generate spoofed traffic to cause a denial of service.

Exploitation requires CAP_NET_ADMIN in a user namespace.

2798) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98235)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak traffic control action references and leave actions registered after successful deletion requests.

The vulnerability exists due to incomplete resource release in tcf_action_put_many() in net/sched/act_api.c when processing a failed batched RTM_DELACTION request. A local user can submit a batch whose deletion fails at an action bound to a filter to leak traffic control action references and leave actions registered after successful deletion requests.

The leaked references belong to subsequent, unprocessed actions in the batch. A later deletion of an unbound action can report success without removing that action from the IDR.

2799) Unchecked Return Value (CVE-ID: CVE-2026-98236)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose kernel heap memory to the network stack.

The vulnerability exists due to an unchecked return value from skb_copy_bits() in mhi_mbim_rx() when processing modem-supplied network transfer blocks. A local user can supply a datagram pointer entry that references data outside the received socket buffer, causing a failed copy and subsequent delivery of an uninitialized buffer to netif_rx(), to disclose kernel heap memory to the network stack.

2800) Infinite loop (CVE-ID: CVE-2026-98237)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an infinite loop caused by unchecked cyclic NDP chains in mhi_mbim_rx() when processing modem-supplied NTBs. A local user can supply a crafted NTB containing an NDP that points to itself or an earlier NDP to cause a denial of service.

2801) Out-of-bounds read (CVE-ID: CVE-2026-98238)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read and invalid pointer dereference.

The vulnerability exists due to an out-of-bounds read in t7xx_ccmni_recv_skb() when processing a DPMAIF PIT header containing an unchecked netif index. A local user can set the netif index to a value between 21 and 31 to cause an out-of-bounds read and invalid pointer dereference.

The out-of-bounds array access reaches an adjacent callback table containing non-null values, which are subsequently interpreted as pointers to struct t7xx_ccmni.

2802) Use-after-free (CVE-ID: CVE-2026-98239)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to write to freed kernel memory.

The vulnerability exists due to use-after-free in lan743x_rx_process_buffer() when processing checksum-success packets that span multiple receive buffers. A remote attacker can send a packet that spans multiple receive buffers to write to freed kernel memory.

Receive checksum offload must be enabled. Multi-buffer reception can occur after a live MTU increase because existing receive ring entries retain their old buffer size until replenished.

2803) Out-of-bounds read (CVE-ID: CVE-2026-98241)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger out-of-bounds reads in kernel memory.

The vulnerability exists due to out-of-bounds reads caused by treating request sockets as full IPv6 sockets in xfrm6_local_rxpmtu() and xfrm6_local_error() when accessing inet_sock or ipv6_pinfo state through skb->sk. A remote attacker can trigger local PMTU or error handling for TCP SYN-ACK packets owned by a request socket to trigger out-of-bounds reads in kernel memory.

The vulnerable path is reachable when rerouting selects an IPv6 XFRM tunnel route with a lower MTU while a TCP_NEW_SYN_RECV request socket remains attached to the packet.

2804) Use-after-free (CVE-ID: CVE-2026-98245)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger access to freed memory in the Linux kernel.

The vulnerability exists due to use-after-free in mark_block_group_to_copy() when iterating over the Btrfs commit root without locking. A local user can trigger iteration concurrently with a transaction commit that swaps and frees the commit root to trigger access to freed memory through extent buffers.

2805) Use-after-free (CVE-ID: CVE-2026-98246)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger access to freed kernel memory.

The vulnerability exists due to use-after-free in the Bluetooth local codec list handling when device closure and a BT_CODEC query execute concurrently. A local user can issue a BT_CODEC query during device closure to trigger access to freed kernel memory.

2806) Out-of-bounds read (CVE-ID: CVE-2026-98247)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in the Bluetooth Read Local Supported Codecs parsers when processing a controller reply that ends immediately after the standard codec array. A local user can supply such a reply to trigger an out-of-bounds read.

The vendor codec count is accessed beyond the socket buffer data while calculating the vendor codec array size. Both command variants are affected.

2807) Out-of-bounds write (CVE-ID: CVE-2026-98248)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt adjacent memory.

The vulnerability exists due to out-of-bounds reads and writes caused by an omitted instruction size suffix in the arm64 per-CPU atomic operations when performing 8-bit or 16-bit operations using LSE instructions. A local user can invoke the affected operations to corrupt adjacent memory.

2808) Use-after-free (CVE-ID: CVE-2026-98249)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in swsusp_arch_suspend_exit() when restoring hypervisor stub vectors during hibernation resume without supplying the required hypervisor call arguments. A local user can trigger a hibernation resume that leaves EL2 referencing freed vector memory to cause a denial of service.

The reported hang occurs with CONFIG_PAGE_POISONING=y and page_poison=on.

2809) Use-after-free (CVE-ID: CVE-2026-98251)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause access to freed kernel memory.

The vulnerability exists due to use-after-free in ovs_ct_get_conn_labels() when adding a labels extension to a confirmed conntrack entry while another CPU accesses its extension block. A local user can trigger label extension allocation during concurrent access to cause access to freed kernel memory.

Exploitation requires a confirmed conntrack entry that does not already have a labels extension.

2810) Race condition (CVE-ID: CVE-2026-98252)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise system confidentiality, integrity, and availability.

The vulnerability exists due to a race condition in reference count initialization in iwpm_get_nlmsg_request() in the Linux kernel RDMA core when publishing a request to a global list before initializing its reference count. A local user can trigger concurrent access to the incompletely initialized request to compromise system confidentiality, integrity, and availability.

2811) Use-after-free (CVE-ID: CVE-2026-98253)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free in the kernel.

The vulnerability exists due to a use-after-free in ucma_process_join() in the RDMA/ucma subsystem when handling concurrent multicast joins and a copy_to_user() failure. A local user can issue concurrent JOIN_MCAST calls for the same address and trigger a response-copy failure to trigger a use-after-free in the kernel.

Multicast leave operations match entries by socket address and destroy the first matching entry. This can cancel the newer RoCE work while an older worker still references the freed ucma_multicast object.

2812) Incorrect calculation (CVE-ID: CVE-2026-98254)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt memory and transfer incorrect data during DMA operations.

The vulnerability exists due to incorrect address calculations in swiotlb_bounce() when performing partial DMA synchronization. A local user can trigger a partial synchronization with an address adjustment that crosses a page boundary to corrupt memory and transfer incorrect data during DMA operations.

A recorded lowmem address that is adjusted into highmem can also cause the lowmem path to pass a highmem address to phys_to_virt().

2813) Improper input validation (CVE-ID: CVE-2026-98255)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to improperly modify TCP connection state.

The vulnerability exists due to improper acknowledgment validation in the TCP receive fast path of tcp_rcv_established() when processing segments with acknowledgment sequence numbers before SND.UNA. A remote attacker can send a TCP segment carrying payload and an excessively old acknowledgment to improperly modify TCP connection state.

The segment's sequence number must match RCV.NXT, and its TCP flags must match the fast-path prediction flags.

2814) Deadlock (CVE-ID: CVE-2026-98257)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by permanently stalling the RDS connection workqueues.

The vulnerability exists due to a deadlock between synchronous connection teardown and shutdown work in rds_ib_cm_connect_complete() when a peer negotiates a protocol version older than RDS_PROTOCOL_COMPAT_VERSION. A remote attacker can negotiate such a protocol version to cause a denial of service by permanently stalling the RDS connection workqueues.

2815) Use-after-free (CVE-ID: CVE-2026-98260)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in POSIX CPU timer cleanup during process execution and termination when a non-leader thread executes a program and a subsequent failure leaves a freed timer node queued. A local user can create and arm a per-thread CPU timer and trigger an execution failure after the thread ID exchange, followed by task reaping, to cause a denial of service.

The affected timer functionality requires CONFIG_POSIX_TIMERS to be enabled.

2816) Use-after-free (CVE-ID: CVE-2026-98261)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise system confidentiality, integrity, and availability.

The vulnerability exists due to use-after-free in cifs_chan_skip_or_disable() when handling a secondary channel that is no longer supported by the server. A remote attacker can trigger the release of a channel reference followed by access to freed server objects to compromise system confidentiality, integrity, and availability.

Both the secondary channel and its primary server can be freed if cifs_put_tcp_session() drops their last references.

2817) Improper initialization (CVE-ID: CVE-2026-98262)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization of the PxCLBU and PxFBU registers in ahci_start_fis_rx() in drivers/ata/libahci.c when probing the ahci driver. A local user can trigger initialization of an affected AHCI controller to cause a denial of service.

The issue occurs on HBAs that support 64-bit addressing but operate with the AHCI_HFLAG_32BIT_ONLY flag. The reported failure leaves a JMicron JMB585 controller unusable.

2818) Use of Uninitialized Variable (CVE-ID: CVE-2026-98263)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an incorrect stream type to be used for a SoundWire audio stream.

The vulnerability exists due to use of an uninitialized variable in rt712_sdca_dmic_hw_params() when configuring a SoundWire audio stream. A local user can trigger audio stream configuration to cause an incorrect stream type to be used for a SoundWire audio stream.

2819) Use-after-free (CVE-ID: CVE-2026-98264)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a device to access freed memory.

The vulnerability exists due to use-after-free in the ALSA virtio sound driver's virtsnd_remove() and virtsnd_freeze() functions when deleting virtqueues before resetting the device. A local user can trigger device removal or freezing to cause a device to access freed memory.

Modern virtio-pci keeps enabled queues active until the device is reset. The affected removal path is also used during probe failures after DRIVER_OK.

2820) Out-of-bounds write (CVE-ID: CVE-2026-98265)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to an out-of-bounds write in the ALSA USB audio driver's implicit feedback handling when processing a capture endpoint packet count that exceeds the playback URB's allocated descriptor capacity. A local user can supply a USB audio device with mismatched implicit feedback capture and playback endpoint parameters to corrupt kernel memory.

The reproducer uses a high-speed UAC2 device declaring bInterval 1 for capture and bInterval 4 for playback. The invalid writes occur on the first capture completion after the audio stream starts.

2821) Use-after-free (CVE-ID: CVE-2026-98266)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to improper device lifetime management in ALSA core (sound/core/init.c) when releasing a sound card asynchronously. A local user can trigger asynchronous card release while in-flight tasks still access the underlying card device to cause a use-after-free.

The disconnection operation gates new accesses but does not prevent access by tasks already in progress.

2822) Improper handling of exceptional conditions (CVE-ID: CVE-2026-98269)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause persistent filesystem inconsistencies.

The vulnerability exists due to improper handling of inode update failures in btrfs_replace_file_extents() when performing hole punching or reflinking. A local user can perform hole punching or reflinking operations that encounter an inode update failure to cause persistent filesystem inconsistencies.

Exploitation requires the transaction to be committed after the inode update failure.

2823) NULL pointer dereference (CVE-ID: CVE-2026-98270)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in nbio_v7_9_handle_ras_controller_intr_no_bifring() when handling an interrupt before the RAS context or PCIE_BIF RAS object is available. A local user can exploit an interrupt occurring during the initialization window to cause a denial of service.

The interrupt handler executes in hard-IRQ context.

2824) Use of uninitialized resource (CVE-ID: CVE-2026-98271)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to stale header offsets referencing uninitialized packet-buffer data in pskb_carve_inside_header() and pskb_carve_inside_nonlinear() when removing initial packet bytes and reallocating the skb head. A local user can trigger RDS-over-TCP packet processing that leaves these stale offsets to cause a denial of service.

The observed kernel BUG occurs when drop_monitor processes packet buffers freed with SKB_DROP_REASON_QUEUE_PURGE during RDS incoming-message cleanup.

2825) Memory corruption (CVE-ID: CVE-2026-98272)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt memory.

The vulnerability exists due to a buffer overflow in the mvpp2 driver's page_pool array during mvpp2_bm_init() when changing the network interface MTU triggers a switch to per-CPU buffering without checking the pool count. A local user can trigger this buffering switch with a receive-queue configuration that exceeds the array capacity to corrupt memory.

The per-CPU buffering scheme requires two pools per receive queue and supports a maximum of eight pools.

2826) Incorrect calculation (CVE-ID: CVE-2026-98275)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leave RX overrun interrupts unacknowledged.

The vulnerability exists due to incorrect interrupt acknowledgment bit selection in the Cortina Gemini Ethernet driver's gmac_irq() function when handling RX overrun interrupts. A local user can trigger RX overrun interrupt handling to leave RX overrun interrupts unacknowledged.

For GMAC0, the acknowledgment writes the GMAC1 overrun bit instead; for GMAC1, the shift leaves no bit set in the 32-bit register.

2827) Use-after-free (CVE-ID: CVE-2026-98276)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in sock_gettstamp() in net/core/sock.c when non-atomic socket flag updates race without holding the socket lock. A local user can race a SIOCGSTAMPNS_NEW ioctl with bind() on a UDP socket to cause a denial of service.

2828) Integer overflow (CVE-ID: CVE-2026-98282)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass I/O bus address range validation.

The vulnerability exists due to incomplete integer overflow and range validation in iommu_tce_check_ioba() in the PowerPC IOMMU code when validating multi-page requests for H_STUFF_TCE or H_PUT_TCE_INDIRECT. A local user can supply a multi-page range that causes arithmetic overflow or exceeds the TCE table capacity to bypass I/O bus address range validation.

The affected validation function is shared by KVM and VFIO.

2829) Use-after-free (CVE-ID: CVE-2026-98283)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger access to freed kernel memory.

The vulnerability exists due to use-after-free in kvmhv_emulate_tlbie_all_lpid() when iterating nested-guest entries and dropping mmu_lock without holding a reference to the nested-guest object. A local user can issue a concurrent single-LPID tlbie operation from another vCPU to trigger access to freed kernel memory.

The memory-release path is fully controlled by the L1 guest. The single-LPID operation uses is=2 and ric=2.

2830) Use of Uninitialized Variable (CVE-ID: CVE-2026-98287)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger reads of uninitialized packet headroom or corrupt packet-buffer state.

The vulnerability exists due to an unsafe protocol-compression undo heuristic in pppoatm_send() when transmit admission fails with protocol compression enabled. A local user can submit packets that encounter transmit admission failure to trigger reads of uninitialized packet headroom or corrupt packet-buffer state through an unbalanced skb_push() operation.

The affected protocol-compression option is SC_COMP_PROT.

2831) Out-of-bounds read (CVE-ID: CVE-2026-98287)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds memory read.

The vulnerability exists due to an out-of-bounds read in pppoatm_send() when inspecting the first data byte of zero-length or non-linear packet buffers. A local user can submit zero-length or non-linear frames to trigger an out-of-bounds memory read.

Frames can reach the affected function through PPP channel bridging (PPPIOCBRIDGECHAN).

2832) Memory corruption (CVE-ID: CVE-2026-98287)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt shared packet headers.

The vulnerability exists due to failure to ensure that packet headers are writable in pppoatm_send() when applying LLC encapsulation to packets received through PPP channel bridging. A local user can submit packets with shared headers through a bridged PPP channel to corrupt shared packet headers.

The affected encapsulation operation prepends a four-byte LLC header.

2833) Deadlock (CVE-ID: CVE-2026-98290)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to lock order inversion in rfcomm_sock_cleanup_listen() when closing unaccepted child sockets concurrently with RFCOMM worker activity. A local user can initiate shutdown of an RFCOMM listening socket while the worker handles connections or DLC state changes to cause a denial of service.

2834) Improper update of reference count (CVE-ID: CVE-2026-98293)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a parent socket resource leak.

The vulnerability exists due to failure to release a parent socket reference in the Bluetooth ISO iso_conn_ready() function when child socket allocation fails. A local user can exercise the affected connection handling error path to cause a parent socket resource leak.

2835) Use-after-free (CVE-ID: CVE-2026-98295)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger access to freed kernel memory.

The vulnerability exists due to use-after-free in the Bluetooth coredump processing component when unregistering a controller during an active coredump. A local user can disconnect the controller during the dump to trigger access to freed kernel memory.

The dump_timeout and dump_rx work items remain active after unregistering and can access the device object after hci_release_dev() frees it.

2836) Race condition (CVE-ID: CVE-2026-98297)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disrupt Bluetooth data transmission.

The vulnerability exists due to a race condition in the Bluetooth hci_send_acl(), hci_send_sco(), and hci_send_iso() functions when socket writes occur concurrently with HCI device shutdown and workqueue draining. A local user can trigger Bluetooth socket writes during workqueue draining to disrupt Bluetooth data transmission.

2837) Out-of-bounds read (CVE-ID: CVE-2026-98298)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause out-of-bounds reads and silent data loss.

The vulnerability exists due to incorrect scatterlist entry length selection in mmp_pdma_prep_slave_sg() when preparing DMA transfers from scatterlists containing entries of different lengths. A local user can trigger processing of such a scatterlist to cause out-of-bounds reads and silent data loss.

2838) Division by zero (CVE-ID: CVE-2026-98299)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to division by zero in the Linux kernel functions tcp_rcvbuf_grow() and tcp_rcv_space_adjust() when processing incoming TCP data with a zero receive-queue space value. A remote attacker can send TCP data that triggers a kernel crash to cause a denial of service.

Exploitation requires tcp_rmem[1] to be configured to a very small value, such as 1.

2839) Race condition (CVE-ID: CVE-2026-98300)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to a race condition in tcp_v6_do_rcv() when processing incoming IPv6 TCP packets concurrently with closure of a listening socket. A local user can close a listening socket during the race window between tcp_v6_rcv() and tcp_v6_do_rcv() to trigger a kernel warning.

The affected path requires IPv6 receive options to be enabled through np->rxopt.all.

2840) Improper locking (CVE-ID: CVE-2026-98301)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in br_mst_set_state() when processing nonzero MSTI state changes through netlink. A local user can request these state changes to cause a denial of service.

The switchdev_port_attr_set() call invokes a blocking notifier chain that may sleep while an RCU read-side critical section is active. Nonzero MSTI changes are processed with the RTNL lock held.

2841) NULL pointer dereference (CVE-ID: CVE-2026-98302)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the Linux kernel skfp FDDI driver's adapter reset path when setting the MAC address on a down interface that has never been brought up. A local privileged user can set the interface's MAC address to trigger a kernel oops and cause a denial of service.

Exploitation requires the CAP_NET_ADMIN capability.

2842) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-98303)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to improper checking of unreachable input routes in icmp_route_lookup() when performing reverse-path route lookup for ICMP output. A local user can supply a packet whose source address resolves to an unreachable input route to trigger a kernel warning.

The reverse-path lookup is reached when the forward output route cannot be used. An unreachable input route can be returned when forwarding is disabled.

2843) Improper access control (CVE-ID: CVE-2026-98306)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass VRF socket isolation.

The vulnerability exists due to improper access control caused by failure to propagate the VRF interface flag in decap_and_validate() in net/ipv6/seg6_local.c when decapsulating IPv4 traffic from SRv6 packets received on VRF-enslaved interfaces. A remote attacker can send SRv6 packets carrying IPv4 traffic that is delivered to an unbound socket outside the ingress VRF to bypass VRF socket isolation.

The behavior is observable with the End.DX4 action during delivery to a local address of the node.

2844) Memory leak (CVE-ID: CVE-2026-98307)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to missing release of station statistics allocations in ath11k_mac_peer_cleanup_all() when recovering from a firmware crash. A local user can encounter firmware-crash recovery with allocated station statistics to cause a memory leak.

The unreleased allocations are arsta->rx_stats and arsta->tx_stats. Recovery calls ieee80211_restart_hw(), which assumes that driver resources have already been cleaned up.

2845) NULL pointer dereference (CVE-ID: CVE-2026-98308)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the ALSA HDA PCM open tracepoint when stream assignment fails because hardware streams are exhausted. A local user can attempt to open a PCM substream under these conditions to cause a denial of service.

The tracepoint payload accesses the assigned stream tag before checking whether stream assignment succeeded.

2846) Use-after-free (CVE-ID: CVE-2026-98309)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to use-after-free in the vc4 driver's KMS output polling when the driver is unbound and scheduled polling work accesses a freed drm_device. A local privileged user can unload the vc4 driver while output polling remains scheduled to cause a denial of service.

2847) Use-after-free (CVE-ID: CVE-2026-98311)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free in the kernel.

The vulnerability exists due to use-after-free in virt_wifi_newlink() when transferring operational state before device registration. A local user can attempt to create a virtual wireless device with an invalid name while its lower device is dormant to trigger a use-after-free in the kernel.

Exploitation requires device registration to fail and a subsequent linkwatch_fire_event() call to access the queued list entry after the device object has been freed.

2848) Out-of-bounds write (CVE-ID: CVE-2026-98312)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in usb6fire_pcm_in_urb_handler() in the ALSA 6fire driver when calculating outgoing isochronous packet sizes from device-reported input lengths. A local user can supply isochronous packets whose reported lengths cause output buffer writes to exceed the allocated buffer to cause a denial of service.

Zero-length isochronous packets are legal on the USB bus. At 88.2/96 kHz, eight full 420-byte input packets can produce 5024 bytes of output for a 4832-byte buffer.

2849) NULL pointer dereference (CVE-ID: CVE-2026-98314)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in ALSA PCM timer initialization when concurrent timer callbacks execute before the registered timer's private data is initialized. A local user can read /proc/asound/timers concurrently with PCM timer initialization to cause a denial of service.

2850) Memory leak (CVE-ID: CVE-2026-98319)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to deplete kernel memory.

The vulnerability exists due to a memory leak caused by incomplete error-path cleanup in prepare_signaling() in the DRM subsystem when handling a request that provides an out_fence_ptr without DRM_MODE_PAGE_FLIP_EVENT and encounters an allocation failure or a failure in setup_out_fence(). A local user can trigger an error path that leaves a drm_pending_vblank_event unreleased to deplete kernel memory.

2851) Use-after-free (CVE-ID: CVE-2026-98320)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to use-after-free in the netfilter flowtable component when the flowtable datapath accesses connection-tracking state after its reference has been released. A local user can access prematurely released connection-tracking state to compromise confidentiality, integrity, and availability.

RCU typesafe semantics also allow a flowtable datapath reference to resolve to the wrong connection-tracking object.

2852) Use of Uninitialized Variable (CVE-ID: CVE-2026-98322)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause uninitialized stack data to be used during IPv4 address mapping.

The vulnerability exists due to use of an uninitialized variable in nft_nat_setup_netmap() when constructing an IPv4 netmap address. A local user can trigger IPv4 netmap processing to cause uninitialized stack data to be used during IPv4 address mapping.

Only the 4-byte IPv4 member of the 16-byte address union is initialized before the entire union is copied into the address range passed to nf_nat_setup_info(). The IPv6 path initializes all 16 bytes and is not affected.

2853) Out-of-bounds write (CVE-ID: CVE-2026-98323)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt receive-state memory.

The vulnerability exists due to an out-of-bounds write in the Linux kernel RDMA/siw siw_get_hdr() function when receiving an extended DDP/RDMAP header across multiple TCP callbacks. A remote attacker can send a fragmented extended DDP/RDMAP header to corrupt receive-state memory.

2854) Improper initialization (CVE-ID: CVE-2026-98325)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to prevent failed wireless transmissions from being reported to userspace.

The vulnerability exists due to improper initialization of socket buffer transmit metadata in the mac80211 transmit path when handling transmit header construction and socket buffer resizing failures. A local user can trigger the affected transmit failure paths to prevent failed wireless transmissions from being reported to userspace.

2855) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98326)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to failure to release an acquired channel context in ieee80211_join_mesh() when mesh startup fails. A local user can trigger a mesh startup failure followed by interface removal to trigger a kernel warning.

During interface removal, the channel context is unassigned after the interface has already been removed from the driver.

2856) Memory leak (CVE-ID: CVE-2026-98327)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak and leave stale channel-switch state.

The vulnerability exists due to incomplete cleanup of allocated memory and channel-switch state in ieee80211_stop_mesh() when leaving a mesh network while a channel switch is pending. A local user can leave the mesh before the channel switch completes to cause a memory leak and leave stale channel-switch state.

2857) Incorrect Calculation of Buffer Size (CVE-ID: CVE-2026-98328)

CWE-ID: CWE-131 - Incorrect Calculation of Buffer Size

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disrupt wireless scanning.

The vulnerability exists due to incorrect calculation of the probe request element buffer size in the mac80211 wireless subsystem when building probe request elements. A local user can initiate a wireless scan to disrupt wireless scanning.

The issue requires hardware support for 6 GHz. The HE 6 GHz Band Capability element is included in probe requests for every band when this support is present.

2858) Improper input validation (CVE-ID: CVE-2026-98329)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to insufficient validation of requested transmission bandwidth in mac80211 radiotap parsing when processing frames injected through a monitor interface. A local user can inject a frame with a radiotap field requesting bandwidth wider than the operational channel bandwidth to trigger a kernel warning.

The reported warning occurs in hwsim when the requested bandwidth is passed to the driver.

2859) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-98331)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to retaining references to unregistered interfaces in the mac80211 interface list when unregistering a network device without going through ieee80211_if_remove(). A local user can trigger destruction of a network namespace containing a wiphy to cause a denial of service.

Exploitation depends on allocation failures preventing the wiphy from being moved to the initial network namespace. Subsequent hardware unregistration can trigger a kernel BUG.

2860) Improper handling of exceptional conditions (CVE-ID: CVE-2026-98334)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of failure conditions in the mac80211 ieee80211_start_ap() function when access point startup fails after setting beaconing state. A local user can trigger a failed access point startup followed by scanning to cause a denial of service.

The divide error was observed with the mac80211_hwsim driver.

2861) NULL pointer dereference (CVE-ID: CVE-2026-98335)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in mac80211 mesh channel-switch finalization when a mesh interface leaves the mesh with a channel switch still active. A local user can trigger departure from the mesh during an active channel switch to cause a denial of service.

Leaving the mesh releases the channel context, but pending channel-switch finalization work subsequently attempts to rebuild the mesh beacon.

2862) Improper input validation (CVE-ID: CVE-2026-98336)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause unsupported traffic control setup on purely virtual interfaces to be passed to drivers.

The vulnerability exists due to insufficient validation of interface types in ieee80211_netdev_setup_tc() in mac80211 when configuring traffic control offloading on AP_VLAN interfaces. A local user can request traffic control offloading on an AP_VLAN interface to cause unsupported traffic control setup on purely virtual interfaces to be passed to drivers.

2863) Race condition (CVE-ID: CVE-2026-98337)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to a race condition in __ieee80211_roc_work() in net/mac80211/offchannel.c when processing remain-on-channel work concurrently with a wireless scan. A local user can cause a remain-on-channel operation to start during a scan to trigger a kernel warning.

The problematic sequence involves pending remain-on-channel work, an initially empty remain-on-channel list, and a newly queued operation. The warning occurs in ieee80211_start_next_roc().

2864) Incorrect comparison (CVE-ID: CVE-2026-98339)

CWE-ID: CWE-697 - Incorrect Comparison

CVSSv4: 0 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a kernel warning.

The vulnerability exists due to incorrect BSS type comparison in cfg80211_update_assoc_bss_entry() when updating an associated access point's BSS entry after a channel change. A remote attacker can operate a rogue access point that switches to a channel containing an existing BSS entry with a mismatched advertised type to trigger a kernel warning.

The retained entry collides with the associated access point's entry in the BSS red-black tree during cfg80211_rehash_bss().

2865) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-98340)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger kernel warnings and prevent beacon data from being populated or updated for grouped BSS entries.

The vulnerability exists due to improper validation of beacon data presence in cfg80211 BSS grouping when processing probe responses and subsequent hidden-SSID beacons. A remote attacker can transmit probe responses that cause entries without beacon data to be grouped, followed by a hidden-SSID beacon with the same BSSID and channel, to trigger kernel warnings and prevent beacon data from being populated or updated for grouped BSS entries.

A hidden SSID can be zero-length or NUL-filled.

2866) Use-after-free (CVE-ID: CVE-2026-98342)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to use-after-free in the Linux kernel DMA engine when releasing a DMA device while concurrent RCU readers traverse the device list. A local user can trigger concurrent device release and list traversal to trigger a use-after-free.

Holding a dmaengine reference to the provider module no longer guarantees that the DMA device remains alive.

2867) Use-after-free (CVE-ID: CVE-2026-98343)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free read in the kernel.

The vulnerability exists due to use-after-free in dma_chan_put() and dma_release_channel() when releasing a DMA channel drops the last reference to its device and frees the device and its channels. A local user can trigger DMA channel release to trigger a use-after-free read in the kernel.

2868) Improper update of reference count (CVE-ID: CVE-2026-98344)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference counting in dma_chan_put() in drivers/dma/dmaengine.c when releasing DMA channels acquired through the fast path. A local user can cycle dmaengine_get() and dmaengine_put() to cause a denial of service.

Exploitation requires a non-private DMA provider with a persistent client keeping chan->client_count greater than zero.

2869) Use of Uninitialized Variable (CVE-ID: CVE-2026-98345)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect classification of transmitted IP frames.

The vulnerability exists due to use of uninitialized memory caused by missing IP header length checks in cfg80211_classify8021d() when processing outgoing frames with undersized IP headers. A local user can transmit a frame marked as IPv4 or IPv6 with an incomplete IP header to cause incorrect classification of transmitted IP frames.

2870) Race condition (CVE-ID: CVE-2026-98347)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the Linux kernel IPoIB interface state handling when a light multicast flush overlaps with interface shutdown. A local user can bring an IPoIB interface down during a multicast flush to cause a denial of service by leaving IPOIB_FLAG_OPER_UP set after shutdown, resulting in endless workqueue retries and an interface teardown deadlock.

2871) Out-of-bounds read (CVE-ID: CVE-2026-98348)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger an out-of-bounds read.

The vulnerability exists due to unsigned length arithmetic wrapping in libipw_handle_assoc_resp() when processing association response frames shorter than the 30-byte fixed prefix. A remote attacker can send a truncated association response frame to trigger an out-of-bounds read.

The ipw2100 and ipw2200 management receive paths check only for the generic 24-byte three-address header before reaching this function. The wrapped length is truncated to a 16-bit value near 64 KiB and passed to libipw_parse_info_param(), which reads beyond the receive buffer.

2872) Out-of-bounds read (CVE-ID: CVE-2026-98349)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger reads beyond the allocated receive buffer.

The vulnerability exists due to an out-of-bounds read in libipw_network_init() and libipw_parse_info_param() when processing beacon or probe response frames shorter than the required 36-byte prefix. A remote attacker can send a specially crafted wireless management frame to trigger reads beyond the allocated receive buffer.

A 24-byte frame causes the information element length calculation to wrap and truncate to 65524, making the parser treat the buffer as containing almost 64 KiB of information elements.

2873) Memory leak (CVE-ID: CVE-2026-98351)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause kernel memory leaks.

The vulnerability exists due to failure to free socket buffers in virt_wifi_start_xmit() when transmitting packets while the simulated link is disconnected. A local user can send packets through the disconnected simulated link to cause kernel memory leaks.

2874) Race condition (CVE-ID: CVE-2026-98352)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a shared completion queue credit leak.

The vulnerability exists due to a race condition in the Linux kernel RDMA RTRS client when handling address resolution concurrently with connection teardown after an interrupted connection attempt. A local user can interrupt a connection attempt while the address resolution handler races with teardown to cause a shared completion queue credit leak.

Subsequent RDMA device unregistration triggers a kernel warning in ib_cq_pool_cleanup() if completion queue credits remain allocated.

2875) Memory leak (CVE-ID: CVE-2026-98354)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service through memory exhaustion.

The vulnerability exists due to a receive buffer memory leak in ib_mad_complete_recv() in the RDMA MAD subsystem when processing management datagrams that fail PKey enforcement. A remote attacker can repeatedly send management datagrams with an incorrect PKey to cause a denial of service through memory exhaustion.

Each rejected datagram leaks approximately 300 bytes for an InfiniBand port or approximately 2 KB for OPA.

2876) Use-after-free (CVE-ID: CVE-2026-98357)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the Linux kernel iSER target's deferred control PDU completion handling when queued completion work executes after connection teardown has freed the connection objects. A local user can trigger connection teardown while control PDU completions remain queued to cause a denial of service.

The affected completion states are ISTATE_SEND_TASKMGTRSP, ISTATE_SEND_REJECT and ISTATE_SEND_TEXTRSP. ISTATE_SEND_LOGOUTRSP follows a separate logout wait path.

2877) NULL pointer dereference (CVE-ID: CVE-2026-98358)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the iSER initiator's iser_check_remote_inv() and iser_inv_desc() functions when processing remote invalidations for unregistered data directions. A remote attacker can respond to a write command with IB_WR_SEND_WITH_INV to cause a denial of service.

The triggering write command sends all of its data as immediate data. Exploitation requires control of the target responding to the initiator.

2878) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-98359)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an RDMA port query to operate on an unregistered and uninitialized network device.

The vulnerability exists due to a missing registration-state check in ib_get_eth_speed() when processing asynchronous RDMA port queries during network device unregistration. A local user can trigger an asynchronous RDMA port query to cause an RDMA port query to operate on an unregistered and uninitialized network device.

The reference returned by ib_device_get_netdev() keeps the network device structure allocated but does not ensure that the device remains operational. The ethtool callback can be invoked after NETDEV_UNREGISTER and ndo_uninit have completed.

2879) Use-after-free (CVE-ID: CVE-2026-98360)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free in the kernel.

The vulnerability exists due to a use-after-free in the RDMA/rxe multicast-group handling code when a failed multicast-address operation frees a group that remains published in the multicast-group tree. A local user can request a subsequent attachment to the same multicast group to trigger a use-after-free in the kernel.

This path is reachable through ATTACH_MCAST on a UD queue pair. The initial rxe_mcast_add() failure can occur when the backing network device has been removed or dev_mc_add() returns an error.

2880) Out-of-bounds read (CVE-ID: CVE-2026-98362)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect clock rates to be reported to consumers.

The vulnerability exists due to an out-of-bounds read in scpi_dvfs_recalc_rate() in the SCPI clock driver when recalculating a clock rate using an out-of-range DVFS index returned by SCP firmware. A local user can trigger clock-rate recalculation using such an index to cause incorrect clock rates to be reported to consumers.

The SCP firmware may supply the invalid index because it is buggy or returns a stale value.

2881) Out-of-bounds read (CVE-ID: CVE-2026-98363)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause out-of-bounds reads and populate the operating performance point table with invalid entries.

The vulnerability exists due to an out-of-bounds read caused by a missing upper-bound check in scpi_dvfs_get_info() when processing operating performance point counts from SCP firmware replies. A local user can supply a firmware reply with a count greater than MAX_DVFS_OPPS to cause out-of-bounds reads and populate the operating performance point table with invalid entries.

2882) Integer overflow (CVE-ID: CVE-2026-98365)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow in the Linux kernel RDMA/rxe mr_check_range() function when validating memory ranges supplied in RDMA read or write requests. A remote attacker can send a specially crafted RDMA request whose address and length cause arithmetic wraparound, bypassing the range check and triggering an out-of-bounds read or write and a kernel oops to cause a denial of service.

2883) Use-after-free (CVE-ID: CVE-2026-98366)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Linux kernel RDMA/rxe memory registration and cleanup code when re-registering a memory region with both protection-domain and access changes and unsupported access flags. A local user can trigger a failed re-registration followed by memory-region deregistration, protection-domain deallocation, and memory-window cleanup to cause a denial of service.

2884) Use-after-free (CVE-ID: CVE-2026-98367)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to use-after-free in the RDMA/siw siw_accept() function when cleaning up after a failed siw_qp_modify() call. A local user can trigger a concurrent queue pair transition to the error state to corrupt kernel memory.

Exploitation requires the concurrent transition to occur after the queue pair state lock is released but before connection endpoint cleanup completes.

2885) Memory leak (CVE-ID: CVE-2026-98368)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak kernel page memory.

The vulnerability exists due to missing release of a destination-page reference in esp_output_tail() and skb_release_data() when processing out-of-place ESP output containing zerocopy managed fragments. A local user can trigger this processing to leak kernel page memory.

The destination page retains a reference while SKBFL_MANAGED_FRAG_REFS remains set, causing skb_release_data() to take its skip_unref branch. The leak occurs at packet rate.

2886) Use-after-free (CVE-ID: CVE-2026-98368)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free of zerocopy pages.

The vulnerability exists due to incorrect page reference counting in the ESP output path and esp_ssg_unref() when processing out-of-place output containing zerocopy managed fragments. A local user can trigger this processing to cause a use-after-free of zerocopy pages.

The affected pages remain pinned while their reference counts fall below the GUP pin bias.

2887) Improper locking (CVE-ID: CVE-2026-98369)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger kernel RCU lockdep warnings.

The vulnerability exists due to missing RCU read-side locking and insufficient object lifetime management in xfrm_trans_reinject() and xfrm_trans_queue_net() when reinjecting transport-mode packets through a workqueue. A local user can cause transport-mode packets to undergo deferred reinjection to trigger kernel RCU lockdep warnings.

Under CONFIG_PREEMPT_RCU, workqueue workers run in process context where local_bh_disable() does not establish an RCU read-side critical section. Queued packets may carry non-reference-counted destination entries, and network-device unregistration can replace a destination's device with blackhole_netdev.

2888) Use-after-free (CVE-ID: CVE-2026-98370)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free in the kernel.

The vulnerability exists due to use-after-free in xfrm_alloc_userspi() and xfrm_user_rcv_msg() when processing compat ALLOCSPI requests. A local user can submit a compat ALLOCSPI request that causes a translated child buffer to be attached to the inbound request to trigger a use-after-free in the kernel.

Exploitation depends on a multicast clone sharing skb_shared_info with the request and a compat receiver still copying from the translated child when the request handler frees it.

2889) Incorrect calculation (CVE-ID: CVE-2026-98373)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect destination address calculation in move_hugetlb_page_tables() when skipping a source page table that is absent initially or after unsharing a PMD table. A local user can invoke mremap() with source and destination addresses at different offsets within their page tables to cause a denial of service.

2890) Use-after-free (CVE-ID: CVE-2026-98374)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in tcp_send_synack() when replacing a cloned SYN socket buffer in the retransmit queue without updating the retransmission hint. A local user can initiate a TCP Fast Open connection using sendmsg(MSG_FASTOPEN) and supply an ICMP fragmentation-needed message to cause a denial of service.

Exploitation requires a simultaneous open after the retransmission hint has been armed.

2891) Out-of-bounds read (CVE-ID: CVE-2026-98375)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to insufficient validation of the Ethernet header length in xen/netfront handle_incoming_queue() when processing backend-supplied receive packets. A local user can supply a packet whose first receive slot is shorter than ETH_HLEN and is followed by additional slots to cause a denial of service.

Exploitation requires control over the receive slot lengths supplied by the backend.

2892) Out-of-bounds read (CVE-ID: CVE-2026-98377)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized kernel slab memory.

The vulnerability exists due to an out-of-bounds read caused by insufficient verification of MAC header availability in __vlan_insert_inner_tag() when inserting VLAN tags into undersized frames. A local user can send a one-byte AF_PACKET/SOCK_RAW frame through an IFF_TUN device subjected to repeated VLAN pushes to disclose uninitialized kernel slab memory.

The IFF_TUN device has hard_header_len set to zero. The first VLAN push sets only a hardware-accelerated tag; subsequent pushes reach the helper through a clsact VLAN push action or bpf_skb_vlan_push().

2893) Use-after-free (CVE-ID: CVE-2026-98378)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the BPF link iterator when iterating over unsettled links during link creation. A local user can trigger concurrent BPF link creation and iteration to cause a denial of service.

Exploitation requires anon_inode_getfile() to fail after the iterator acquires a reference to the unsettled link. The reported kernel panic occurred with KASAN panic_on_warn enabled.

2894) NULL pointer dereference (CVE-ID: CVE-2026-98379)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel panic.

The vulnerability exists due to a null pointer dereference in the Linux kernel IPv6 reverse-path filtering component when processing a route without an inet6_dev. A local user can use rtnetlink to lower an external nexthop device's MTU below IPV6_MIN_MTU and trigger an IPv6 reverse-path filtering lookup to cause a denial of service by triggering a kernel panic.

An unprivileged user can construct the required state within a private user namespace and network namespace.

2895) Race condition (CVE-ID: CVE-2026-98380)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition and improper error-pointer validation in tcf_idr_delete_index() in net/sched/act_api.c when deleting traffic control actions. A local user can trigger concurrent action deletion and reservation of the same IDR slot to cause a denial of service.

2896) Use-after-free (CVE-ID: CVE-2026-98381)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the veth driver's XDP program handling when resizing receive channels and detaching or replacing an XDP program. A local user can reduce the receive channel count, detach or replace the XDP program, and subsequently increase the channel count to cause a denial of service.

2897) Out-of-bounds read (CVE-ID: CVE-2026-98382)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering a kernel panic.

The vulnerability exists due to an out-of-bounds read in veth_xdp_rx_timestamp() when executing veth-specific metadata kfuncs on a tun device's xdp_buff. A local privileged user can use bpf(BPF_LINK_CREATE) with a different target interface index to attach a veth-bound program to a tun device to cause a denial of service by triggering a kernel panic.

Exploitation requires both CAP_BPF and CAP_NET_ADMIN capabilities.

2898) Use-after-free (CVE-ID: CVE-2026-98383)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to use-after-free in BPF LWT_SEG6LOCAL handling when performing post-program SRH validation. A local user can run an LWT_SEG6LOCAL program that invalidates its cached SRH with bpf_lwt_seg6_adjust_srh() and then calls bpf_skb_pull_data() to corrupt kernel memory.

Reallocation of skb->head leaves the per-CPU SRH pointer dangling, and subsequent SRH validation writes through that pointer.

2899) Out-of-bounds read (CVE-ID: CVE-2026-98384)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds memory read.

The vulnerability exists due to an out-of-bounds read in bpf_sock_destroy() when processing a timewait or request socket supplied by the TCP iterator. A local user can invoke bpf_sock_destroy() through a TCP iterator BPF program with such a socket to trigger an out-of-bounds memory read.

The sk_protocol field belongs to struct sock and is not present in struct sock_common or the supplied socket objects.

2900) Reliance on undefined behavior (CVE-ID: CVE-2026-98386)

CWE-ID: CWE-758 - Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to the use of ordinary memory operations on device I/O memory in the qla2xxx driver's __qla2x00_alloc_iocbs() function when clearing a QLAFX00 request ring slot. A local user can trigger the affected slot-clearing operation to cause a denial of service.

On architectures such as ARM64, a regular memset() may emit unaligned or block-zeroing instructions that are invalid for device memory, resulting in a synchronous external abort.

2901) Unchecked Return Value (CVE-ID: CVE-2026-98387)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause access to uninitialized memory.

The vulnerability exists due to unchecked return values in the Linux kernel's s390 AES processing routines when initializing or advancing a scatter-gather cipher walk. A local user can trigger affected AES operations following a walk failure to cause access to uninitialized memory.

2902) Infinite loop (CVE-ID: CVE-2026-98394)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through busy-waiting.

The vulnerability exists due to failure to terminate a receive loop in unix_stream_read_generic() in net/unix/af_unix.c when manage_oob() returns NULL for a zero-length receive buffer. A local user can issue a zero-length blocking recv() call with MSG_PEEK on a UNIX domain stream socket whose last queued socket buffer contains MSG_OOB data to cause a denial of service through busy-waiting.

The affected code requires CONFIG_AF_UNIX_OOB to be enabled.

2903) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-98398)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disrupt kernel lock dependency validation.

The vulnerability exists due to insufficient validation of stale lock-class cache entries in the kernel lock dependency validator when acquiring locks whose cached classes have been invalidated. A local user can trigger acquisition of a lock retaining a stale class-cache entry to disrupt kernel lock dependency validation.

The issue can arise after module unloading or lock-key unregistration. Reported behavior includes kernel warnings; reuse of an invalidated class slot can also cause an unrelated lock class to be matched.

2904) NULL pointer dereference (CVE-ID: CVE-2026-98399)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service during dump-and-re-IPL processing.

The vulnerability exists due to a null pointer dereference in dump_reipl_run() when preparing lowcore fields without an available re-IPL parameter block. A local user can trigger the affected dump-and-re-IPL processing to cause a denial of service.

HMC FTP boot and QEMU direct kernel boot may leave the IPL parameter block unavailable. If address zero contains readable lowcore data, processing may continue, but the stand-alone dumper enters disabled wait after completing the dump.

2905) NULL pointer dereference (CVE-ID: CVE-2026-98400)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in set_os_info_reipl_block() when kdump crash shutdown processes an unavailable re-IPL parameter block. A local user can trigger the affected crash-shutdown path to cause a denial of service.

HMC FTP boot and QEMU direct kernel boot may leave the system without an IPL parameter block. The invalid access may succeed by chance if address zero contains readable lowcore data.

2906) Out-of-bounds read (CVE-ID: CVE-2026-98401)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read caused by a stale transport-header offset in qdisc_pkt_len_segs_init() when processing decapsulated packets carrying GSO metadata. A local user can supply a specially crafted encapsulated packet to cause a denial of service.

Exploitation requires the inner frame to be forwarded at layer 2 through a bridge or HSR rather than delivered to the local IP stack. The affected packet-processing path uses gro_cells and reaches __dev_queue_xmit().

2907) Use of Uninitialized Variable (CVE-ID: CVE-2026-98402)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to use of an uninitialized transport header offset in the icmp_send tracepoint when recording ICMP send events. A local user can trigger ICMP error handling for a packet whose transport header has not been initialized to trigger a kernel warning.

The reported warning occurs with CONFIG_DEBUG_NET=y. Relevant processing paths include link failures, ARP errors, forwarding, and AF_PACKET.

2908) Out-of-bounds write (CVE-ID: CVE-2026-98403)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt memory.

The vulnerability exists due to an out-of-bounds write in append_ipl_block_parm() in arch/s390/boot/ipl_parm.c when appending an IPL parameter to a command line that occupies all but the terminating byte of COMMAND_LINE_SIZE. A local user can supply an IPL parameter that causes the conversion helpers to write beyond the early_command_line buffer to corrupt memory.

2909) NULL pointer dereference (CVE-ID: CVE-2026-98404)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in drm_mode_addfb2() when virtio_gpu_user_framebuffer_create() returns a null pointer on an error path. A local user can trigger the framebuffer creation error path to cause a denial of service.

2910) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-98406)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to insufficient validation of the interface's driver-presence state in ieee80211_set_bitrate_mask() when handling wireless bitrate-setting requests. A local user can issue a SIOCSIWRATE ioctl for an interface marked as running but absent from the driver to trigger a kernel warning.

The affected state can occur during interface teardown or during bringup before the interface is added to the driver.

2911) Out-of-bounds write (CVE-ID: CVE-2026-98407)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt unrelated kernel heap objects.

The vulnerability exists due to incorrect pointer arithmetic resulting in an out-of-bounds write in the rsi_hal_load_key() function when removing a key with a null data pointer. A local user can trigger a key-removal operation to corrupt unrelated kernel heap objects.

The write occurs on every DISABLE_KEY callback, including during disconnects, roaming, and interface teardown. It writes 144 zero bytes approximately 2.4 KB beyond the end of a 160-byte heap buffer.

2912) Division by zero (CVE-ID: CVE-2026-98409)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to division by zero in the rtd119x watchdog driver's rtd119x_wdt_probe() function when initializing the watchdog device with a clock rate of zero. A local user can trigger the affected initialization path to cause a denial of service.

2913) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-98410)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through an unexpected system reset.

The vulnerability exists due to incomplete watchdog state checks in da9063_wdt_suspend() and da9063_wdt_resume() when handling system suspend and resume. A local user can trigger system suspend while the hardware watchdog is running but not marked active to cause a denial of service through an unexpected system reset.

The issue occurs when the driver leaves the watchdog running and userspace never opens the watchdog device. The software power-management path must be enabled.

2914) Use of Uninitialized Variable (CVE-ID: CVE-2026-98413)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause SELinux to use uninitialized access-decision data.

The vulnerability exists due to use of an uninitialized stack variable in the SELinux avc_has_perm_noaudit() function when handling an empty requested permission set. A local user can trigger a permission check with an empty requested permission set to cause SELinux to use uninitialized access-decision data.

Callers pass the resulting decision to avc_audit(), and the inode hook also stores it in the per-task decision cache.

2915) NULL pointer dereference (CVE-ID: CVE-2026-98416)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in k3_udma_glue_release_rx_chn() in the Linux kernel TI K3 UDMA glue driver when handling a receive-channel request after memory allocation fails. A local user can trigger the affected cleanup path to cause a denial of service.

The failure occurs when devm_kcalloc() cannot allocate the receive-channel flow array and cleanup subsequently calls k3_udma_glue_release_rx_flow().

2916) Numeric Truncation Error (CVE-ID: CVE-2026-98417)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a kernel warning.

The vulnerability exists due to integer truncation in the handle_esp() function in net/xfrm/espintcp.c when processing ESP-in-TCP packets after the stream parser trims the TCP envelope. A remote attacker can supply packets whose transport header offset cannot be represented to trigger a kernel warning.

2917) Out-of-bounds write (CVE-ID: CVE-2026-98419)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to an out-of-bounds write in reset_per_cpu_data() in the Linux kernel drop_monitor component when zeroing an alert message buffer. A local user can trigger an oversized memset() operation to corrupt kernel memory.

The write extends four bytes beyond the allocated buffer and corrupts skb_shared_info.

2918) Improper input validation (CVE-ID: CVE-2026-98421)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to improper validation of the peer station state in the mac80211 TDLS management component when preparing a TDLS setup confirmation frame. A local user can request a TDLS setup confirmation for a peer without an existing TDLS station to trigger a kernel warning.

2919) Improper initialization (CVE-ID: CVE-2026-98422)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to improper reinitialization of the crypto_tx_tailroom_needed_cnt counter in mac80211 AP_VLAN interface handling when bringing an AP_VLAN interface down. A local user can repeatedly bring the same AP_VLAN interface down and up while its parent AP interface remains up to trigger a kernel warning.

The sanity check detects a mismatch between the AP_VLAN interface's counter and the parent AP interface's counter.

2920) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-98423)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to a time-of-check time-of-use race condition in mac80211_hwsim when processing frames from wmediumd during radio shutdown. A local user can submit frames from userspace concurrently with radio shutdown to trigger a kernel warning.

2921) Reachable assertion (CVE-ID: CVE-2026-98425)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to an unnecessary warning assertion in ieee80211_request_ibss_scan() when requesting an IBSS scan with no channels permitted by the current regulatory domain. A local user can request a scan under this condition to trigger a kernel warning.

The regulatory domain can change while an IBSS is operating, and the IBSS can continue operating briefly during a 60-second grace period before shutdown.

2922) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98426)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak interrupt resources.

The vulnerability exists due to incorrect resource cleanup using the wrong context index in mwifiex_pcie_request_irq() when handling an MSI-X interrupt registration failure. A local user can trigger this error path to leak interrupt resources.

2923) Use-after-free (CVE-ID: CVE-2026-98428)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free in the kernel.

The vulnerability exists due to improper lifetime management of reference-counted USB request blocks in the ALSA USB 6fire driver when releasing embedded USB request blocks asynchronously. A local user can exercise the affected URB release paths to trigger a use-after-free in the kernel.

The affected URBs are embedded in structures used for PCM, MIDI, and communication.

2924) Use-after-free (CVE-ID: CVE-2026-98429)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free and access to uninitialized state in the EFA RDMA driver's completion interrupt handler when event queues are initialized or destroyed. A local user can trigger interrupt handling that accesses event queue state or a DMA buffer outside its valid lifetime to cause a denial of service.

2925) Use-after-free (CVE-ID: CVE-2026-98430)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Linux kernel EFA RDMA driver's management interrupt handler when handling interrupts during device removal. A local user can exploit interrupt handling that accesses already-destroyed admin completion and asynchronous event queues to cause a denial of service.

The lifetime mismatch also permits the interrupt handler to access these queues before they have been initialized during device initialization.

2926) Use-after-free (CVE-ID: CVE-2026-98432)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially cause a denial of service through access to freed IPv6 request socket options.

The vulnerability exists due to use-after-free in tcp_v6_reqsk_destructor() when request socket migration leaves concurrent processing using shared options after they have been freed. A remote attacker can send TCP traffic that encounters concurrent request socket migration and destruction to potentially cause a kernel crash.

The affected ipv6_opt options are only set by CALIPSO.

2927) Use-after-free (CVE-ID: CVE-2026-98432)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to use-after-free in the Linux kernel IPv4 TCP socket option handling when socket destruction frees shared options while another CPU is still using them to build a SYNACK or create a child socket. A remote attacker can send TCP traffic that encounters these concurrent processing paths to potentially cause a kernel crash.

The request socket migration path requires net.ipv4.tcp_migrate_req=1 or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program. IPv6 is not affected by the child socket ownership-transfer path because it duplicates the options.

2928) Memory leak (CVE-ID: CVE-2026-98433)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by exhausting secure memory resources.

The vulnerability exists due to a memory leak in the Linux kernel KVM PowerPC Book3S HV kvmppc_svm_page_in() function when uv_page_in() fails after a secure device page has been allocated. A local user can trigger page-in operations that encounter this error to leave secure device pages and associated metadata unreclaimed, potentially exhausting the firmware-bounded secure memory pool and making affected guest frame numbers unusable for the lifetime of the VM.

The issue is reachable on POWER9/10 systems using Ultravisor/PEF.

2929) Use-after-free (CVE-ID: CVE-2026-98435)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through a kernel crash.

The vulnerability exists due to use-after-free in the Linux kernel Altera EDAC driver's altr_portb_setup() function when an error during port B setup causes device-managed resource cleanup to reference an embedded device after its containing allocation has been freed. A local user can exercise the affected setup error path to potentially cause a kernel crash.

2930) Use-after-free (CVE-ID: CVE-2026-98441)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause kernel memory corruption and potentially a denial of service.

The vulnerability exists due to use-after-free in the Linux kernel act_ct connection tracking action when cloned packets share an unconfirmed connection tracking entry and are processed with different extension sets. A local user can trigger processing in which one clone installs a helper extension but remains unconfirmed, and another adds extensions for labels or NAT, invalidating a pointer in the expectation list, to cause access to freed memory during subsequent destruction.

2931) Use-after-free (CVE-ID: CVE-2026-98442)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service or potentially corrupt kernel memory.

The vulnerability exists due to use-after-free in the Linux kernel connection-tracking action in net/sched/act_ct.c when connection-tracking extensions are reallocated after a helper creates an expectation for an unconfirmed connection. A remote attacker can trigger processing of network traffic that exercises this sequence to leave a stale pointer in the expectations list, potentially causing a kernel crash or memory corruption when the expectation is removed.

2932) Use-after-free (CVE-ID: CVE-2026-98443)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through kernel memory corruption.

The vulnerability exists due to use-after-free in the XFS xlog_recover_iunlink_bucket function when recovering unlinked inode buckets and an inode garbage-collection flush fails. A local user can potentially trigger this recovery error path to cause access to a released inode and a kernel crash.

2933) Improper handling of exceptional conditions (CVE-ID: CVE-2026-98445)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through leaked filesystem blocks or filesystem shutdown.

The vulnerability exists due to improper handling of memory allocation failures in the XFS xrep_newbt_add_blocks function when allocating a reservation object during online filesystem repair. A local user can potentially trigger an allocation failure to leave blocks allocated for a new btree unreleased or cause the filesystem to shut down because the callers cannot both undo the transaction and return an error.

2934) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98450)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak remote SMB file handles, potentially causing a denial of service through resource exhaustion.

The vulnerability exists due to missing resource release in the Linux kernel SMB client's compound_send_recv() function when a later response wait is interrupted or response synchronization fails after an earlier CREATE has completed. A local user can trigger compound SMB operations that encounter these failure conditions to leave successfully opened remote handles unclosed because their file identifiers have not been returned to the caller and cancelled-request cleanup is not invoked.

2935) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98451)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to exhaust kernel resources and potentially cause a denial of service.

The vulnerability exists due to missing release of dentry references in the Linux kernel SMB client's cifs_atomic_open() function when opening an existing symbolic link with O_CREAT. A local user can repeatedly perform these opens on a CIFS filesystem to accumulate unreleased references and potentially cause a denial of service.

2936) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98452)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause SMB directory handle leaks that may lead to a denial of service through resource exhaustion.

The vulnerability exists due to improper cleanup of opened directory handles and insufficient response validation in the Linux kernel SMB client's open_cached_dir() function when processing compound CREATE and QUERY_INFO responses. A remote attacker can supply server responses in which CREATE succeeds but a subsequent command fails to leave the successfully opened directory handle unclosed, potentially exhausting resources.

2937) Missing Release of File Descriptor or Handle after Effective Lifetime (CVE-ID: CVE-2026-98453)

CWE-ID: CWE-775 - Missing Release of File Descriptor or Handle after Effective Lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause resource leakage that may lead to a denial of service.

The vulnerability exists due to missing release of a remote handle in the Linux kernel SMB client's SMB2_open() function when parsing malformed create contexts in a successful CREATE response. A remote attacker can return a specially crafted response from an SMB server to leave a server-side handle open and the num_remote_opens count elevated, potentially causing resource exhaustion through repeated failures.

2938) Out-of-bounds read (CVE-ID: CVE-2026-98454)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger out-of-bounds memory reads that may disclose sensitive information or cause a denial of service.

The vulnerability exists due to out-of-bounds reads in the Linux kernel SMB client's create-context and lease parsers when processing malformed SMB2/SMB3 create responses. A remote attacker can supply a crafted response from an SMB server with inconsistent context boundaries, data offsets, or data lengths to cause handlers to read beyond the current context or interpret unrelated bytes as file identifiers or lease data, potentially exposing sensitive information or causing a denial of service.

2939) NULL pointer dereference (CVE-ID: CVE-2026-98455)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to cause a denial of service by triggering a Linux kernel crash.

The vulnerability exists due to a null pointer dereference in the Bluetooth RFCOMM_CONNINFO getsockopt handler when processing an accepted socket whose deferred setup flag remains set after its session has been removed. A remote attacker on the local network can send a Bluetooth RFCOMM DISC frame for a channel accepted with BT_DEFER_SETUP enabled to cause a kernel crash if a local application subsequently calls getsockopt(SOL_RFCOMM, RFCOMM_CONNINFO) on that socket.

2940) Out-of-bounds write (CVE-ID: CVE-2026-98456)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory, potentially causing a denial of service.

The vulnerability exists due to a race condition leading to an out-of-bounds write in the Bluetooth management function read_unconf_index_list() when controller flags change between counting eligible controllers and filling the response. A local user can request the unconfigured controller index list during asynchronous controller setup to trigger a write beyond the allocated response buffer, potentially crashing the kernel.

2941) Out-of-bounds read (CVE-ID: CVE-2026-98457)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to trigger out-of-bounds reads that may cause a denial of service or disclose kernel memory.

The vulnerability exists due to out-of-bounds reads in the Linux kernel Bluetooth L2CAP receive path when processing short ERTM or streaming-mode frames. A remote attacker on the local network can send a frame with an incomplete two-byte or four-byte control field, or an insufficient CRC16 frame check sequence, to trigger reads beyond the frame boundary. In the CRC16 case, subtracting two from the remaining length can wrap, leaving the buffer unchanged before the frame check sequence is read.

2942) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98458)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to exhaust connection resources, potentially causing a denial of service.

The vulnerability exists due to missing release of unused connection references in the Linux kernel Bluetooth ISO connection handling code when channel attachment reuses an existing association or fails because another socket is already attached. A local user can repeatedly trigger these channel attachment cases through ISO socket connection attempts to accumulate unreleased connection references and potentially exhaust resources.

2943) Improper update of reference count (CVE-ID: CVE-2026-98459)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by prematurely disconnecting a Bluetooth connection that is still in use.

The vulnerability exists due to improper reference counting in the Linux kernel Bluetooth ISO hci_bind_bis() function when linking an additional broadcast isochronous stream to an existing parent connection. A local user can trigger linking and subsequent unlinking of the child connection to drop the parent's existing operational hold, potentially scheduling the parent for disconnection while its socket is still using it.

2944) Incorrect authorization (CVE-ID: CVE-2026-98460)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass Bluetooth HCI command restrictions and submit reserved opcodes through an unprivileged raw HCI socket.

The vulnerability exists due to improper authorization in the Linux kernel Bluetooth raw HCI socket security filter when checking command opcodes. A local user can submit a reserved opcode whose 10-bit opcode command field (OCF) aliases an allowlisted command after masking with 127 to bypass the command security filter.

A conforming controller should reject reserved opcodes.

2945) Out-of-bounds read (CVE-ID: CVE-2026-98461)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering an out-of-bounds read in the kernel.

The vulnerability exists due to an out-of-bounds read in the Bluetooth is_filtered_packet() function when filtering event packets before their lengths are validated. A local user can supply a malformed event through a controller or vhci device to trigger reads beyond an empty event buffer or a truncated command event, potentially causing a kernel crash.

2946) Improper update of reference count (CVE-ID: CVE-2026-98462)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through premature release of Bluetooth connection objects.

The vulnerability exists due to improper reference counting in the Linux kernel Bluetooth hci_bind_cis() and hci_connect_cis() functions when reusing connected isochronous stream (CIS) connections or handling configuration failures. A local user can trigger affected connection-handling paths to cause connection holds to be dropped without a corresponding acquisition, potentially leading to premature object release and a kernel crash.

2947) Use-after-free (CVE-ID: CVE-2026-98464)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger use-after-free in the host kernel, potentially causing a denial of service.

The vulnerability exists due to use-after-free in the RISC-V KVM non-Sstc vCPU timer implementation when teardown frees a vCPU without synchronizing with a running timer callback. A local user can arm the timer from a guest using SBI TIME and request shutdown using SBI legacy shutdown or SRST to race the callback against vCPU destruction, potentially crashing the host when the VMM honors KVM_EXIT_SYSTEM_EVENT and destroys the VM.

2948) Race condition (CVE-ID: CVE-2026-98465)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read or modify another vCPU's interrupt file without authorization.

The vulnerability exists due to a race condition in the RISC-V KVM IMSIC attribute handling code when device ioctl operations run concurrently with vCPU migration. A local user can race a GET or SET attribute operation against migration to access another vCPU's interrupt file through stale physical CPU and HGEI values.

2949) Double free (CVE-ID: CVE-2026-98473)

CWE-ID: CWE-415 - Double Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through a double-free during resource cleanup.

The vulnerability exists due to a potential double-free in the Linux kernel s390 vfio-ap function vfio_ap_free_aqic_resources() when cleanup runs after vfio_ap_mdev_unset_kvm() has cleared the KVM pointer. A local user can exercise repeated resource cleanup under this teardown condition to encounter a saved_isc value that was not invalidated, potentially causing a double-free and a denial of service.

2950) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98473)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through leaked host resources.

The vulnerability exists due to missing resource release in the Linux kernel s390 vfio-ap reset-completion path when apq_status_check() encounters AP_RESPONSE_Q_NOT_AVAIL while checking a queue removed from the host's AP configuration. A local user can use a guest with interrupt handling enabled for the assigned queue under these removal conditions to leave KVM GISC registrations and pinned guest notification pages unreleased because apq_reset_check() does not perform the required cleanup, potentially exhausting host resources.

2951) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98473)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through leaked host resources.

The vulnerability exists due to missing resource release in the Linux kernel s390 vfio-ap function vfio_ap_mdev_reset_queue() when a queue reset returns AP_RESPONSE_Q_NOT_AVAIL during removal from the host's AP configuration. A local user can use a guest with interrupt handling enabled for the assigned queue under these removal conditions to leave KVM GISC registrations and pinned guest notification pages unreleased, potentially exhausting host resources.

2952) NULL pointer dereference (CVE-ID: CVE-2026-98476)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering a kernel null pointer dereference.

The vulnerability exists due to a missing null-pointer check in ccw_device_get_util_str() in the Linux kernel s390 channel I/O subsystem when a subchannel's PMCW still references a CHPID whose channel path registry entry has been removed. A local user can trigger the affected lookup under this condition to potentially crash the kernel when the null pointer returned by chpid_to_chp() is dereferenced.

2953) NULL pointer dereference (CVE-ID: CVE-2026-98477)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a kernel null pointer dereference.

The vulnerability exists due to a null pointer dereference in the Linux kernel performance-monitoring task-scheduling code when a null PMU context is passed to armv8pmu_sched_task() on systems using BRBE. A local user can trigger the affected scheduling path to cause a kernel oops and potentially disrupt system availability.

2954) Improper input validation (CVE-ID: CVE-2026-98479)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt application write buffers and cached file data on an iSCSI initiator.

The vulnerability exists due to insufficient validation of command data direction in the Linux kernel's libiscsi_tcp component when processing a Data-In PDU referencing a WRITE command. A remote attacker can operate a malicious iSCSI target and send a Data-In PDU naming an outstanding WRITE command's initiator task tag to overwrite the caller's pinned pages for a direct write or page cache pages for a buffered write with target-supplied data.

2955) Out-of-bounds read (CVE-ID: CVE-2026-98481)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to system to trigger an out-of-bounds kernel memory read that may cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the Linux kernel NFC port100 driver when validating device-supplied response frames without checking their declared length against the actual received length. An attacker with physical access to system can supply a response with a 16-bit datalen value exceeding the received data length to make port100_data_checksum() read past the transfer buffer, potentially causing a kernel crash.

2956) Use of Uninitialized Variable (CVE-ID: CVE-2026-98482)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 0 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to cause the kernel to process uninitialized memory as NFC LLCP sequence data.

The vulnerability exists due to use of uninitialized memory in nfc_llcp_recv_hdlc() when processing truncated NFC LLCP PDUs without checking that the sequence byte is present. A remote attacker on the local network can send a two-byte I, RR or RNR PDU to cause the kernel to read uninitialized skb tailroom and use the byte as N(R)/N(S) sequence data.

2957) Use-after-free (CVE-ID: CVE-2026-98483)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through access to freed kernel memory.

The vulnerability exists due to use-after-free in the Linux kernel NFC functions nfc_llcp_general_bytes() and nfc_get_local_general_bytes() when retrieving local general bytes. Releasing the local object's reference can free the object before callers access the returned pointer. A local user can potentially trigger affected NFC operations that dereference this stale pointer to cause a kernel crash and denial of service.

2958) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-98484)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disrupt nftables catchall rule matching and interfere with catchall element insertion and deletion.

The vulnerability exists due to improper handling of expired resources in nft_setelem_catchall_insert() and nft_setelem_catchall_deactivate() when processing catchall element insertion and deletion requests. A local privileged user can manipulate catchall elements with timeouts so that expired entries block reinsertion or are selected for deletion instead of fresh entries, causing catchall rules to stop matching or element management requests to behave incorrectly.

Stale entries remain until the user-tunable garbage collection interval elapses, potentially prolonging the failure for an arbitrarily long time.

2959) Out-of-bounds read (CVE-ID: CVE-2026-98485)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by triggering a kernel panic.

The vulnerability exists due to an out-of-bounds read in the Linux kernel netfilter rt_mt6() function when processing IPv6 routing addresses under a non-strict address-matching rule with IP6T_RT_FST_MASK set and rtinfo->addrnr equal to zero. A remote attacker can send a crafted IPv6 packet containing matching routing addresses to advance the address index beyond the 16-entry array and cause a denial of service through a kernel panic.

2960) Memory leak (CVE-ID: CVE-2026-98486)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially exhaust kernel memory and cause a denial of service.

The vulnerability exists due to a memory leak in the Linux kernel ENA driver's ena_probe() error path when device probing fails after ena_device_init() succeeds. A local privileged user can potentially trigger repeated probe failures to leave coherent DMA buffers allocated, exhausting kernel memory and potentially causing a denial of service.

2961) Use-after-free (CVE-ID: CVE-2026-98487)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by potentially crashing the kernel.

The vulnerability exists due to a use-after-free in the Linux kernel bridge multicast database code when deleting multicast port groups. A local privileged user can trigger port group deletion followed by an RTM_GETMDB request to cause an access to freed memory and potentially crash the kernel. Reentrant deletion can unlink other port groups, invalidating the traversal cursor in br_mdb_flush_pgs() and leaving the port list pointing to freed memory that br_mdb_dump() subsequently reads.

2962) Infinite loop (CVE-ID: CVE-2026-98488)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a CPU soft lockup.

The vulnerability exists due to an unreachable loop termination condition in the Linux kernel atl1e driver's atl1e_clean_tx_irq() function when hardware reports an out-of-range hw_next_to_clean value during a PCIe link or MAC reset. A local user can trigger the affected transmit cleanup path under these conditions to cause an infinite loop and a CPU soft lockup.

2963) Infinite loop (CVE-ID: CVE-2026-98489)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to cause a denial of service through a kernel CPU soft lockup.

The vulnerability exists due to an infinite loop with an unreachable exit condition in the Linux kernel atl1c driver's transmit cleanup routine when the hardware reports an out-of-range transmit descriptor consumer index during a PCIe link or MAC reset. A remote attacker on the local network can trigger a link reset by rebooting a directly connected network device to cause the cleanup loop to spin indefinitely if the hardware returns the invalid index.

2964) Use-after-free (CVE-ID: CVE-2026-98490)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service and potentially corrupt kernel memory.

The vulnerability exists due to a use-after-free in the Linux kernel Open vSwitch connection tracking component when connection tracking extensions are reallocated after helper processing for an unconfirmed connection. A local user can trigger the affected helper and extension-allocation sequence to leave a stale pointer in the expectations list, causing access to freed memory during expectation removal and potentially crashing the kernel.

2965) Use-after-free (CVE-ID: CVE-2026-98491)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially cause a denial of service through kernel memory corruption.

The vulnerability exists due to use-after-free in the Linux kernel Open vSwitch connection-tracking component when cloned packets sharing an unconfirmed connection-tracking entry are committed with different extension sets. A remote attacker can trigger packet processing through the affected commit sequence to invalidate an extension pointer in the expectation list, potentially causing a kernel crash when the entry is later destroyed.

2966) Out-of-bounds write (CVE-ID: CVE-2026-98493)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service during Linux kernel boot.

The vulnerability exists due to an out-of-bounds write in ic_dhcp_init_options() in net/ipv4/ipconfig.c when constructing boot-time DHCP options without checking the space remaining for hostname and vendor-class values. A local privileged user can supply a combination of hostname and dhcpclass= values that exceeds the fixed 312-byte bootp_pkt.exten[] buffer to overwrite adjacent memory and disrupt boot, including triggering a kernel panic when CONFIG_FORTIFY_SOURCE and panic_on_warn=1 are enabled.

2967) Infinite loop (CVE-ID: CVE-2026-98494)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a soft lockup.

The vulnerability exists due to an unreachable loop exit condition in the Linux kernel atl1 driver's atl1_intr_tx() function when hardware reports an out-of-range transmit descriptor consumer index during a PCIe link or MAC reset. A local user can potentially induce an infinite transmit cleanup loop to cause a denial of service if able to trigger this hardware condition.

2968) Out-of-bounds read (CVE-ID: CVE-2026-98495)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds read of kernel stack memory, potentially causing a denial of service.

The vulnerability exists due to missing NUL termination of the arp_dev field in the Linux kernel ARP ioctl handler when looking up a user-supplied interface name. A local user can submit a struct arpreq containing IFNAMSIZ bytes without a NUL terminator in arp_dev to cause strcmp() to read beyond the stack object during lookup through dev_get_by_name_rcu() or __dev_get_by_name() when a matching alternative interface name exists.

2969) Improper update of reference count (CVE-ID: CVE-2026-98498)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause resource retention that may lead to a denial of service.

The vulnerability exists due to a missing reference count decrement in mlx5_tc_ct_shared_counter_get() in the Linux kernel mlx5 driver when a reverse entry is found but its counter is already being released. A local user can trigger shared counter lookups under this condition to leave reverse entries permanently referenced, potentially exhausting resources and causing a denial of service.

2970) Out-of-bounds read (CVE-ID: CVE-2026-98499)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose kernel memory contents.

The vulnerability exists due to an out-of-bounds read in the Linux kernel Wacom HID driver's wacom_wac_pen_serial_enforce() function when processing reports whose HID descriptor declares more usages than its report count reserves space for. A local user can supply a crafted HID descriptor and report to cause hid_field_extract() to read beyond the report buffer and expose the extracted value to userspace through an MSC_SERIAL event.

2971) Use-after-free (CVE-ID: CVE-2026-98501)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through a kernel crash.

The vulnerability exists due to use-after-free in the Linux kernel ALPS HID driver when handling input reports after input device registration fails. A local user can trigger processing of a U1_SP_ABSOLUTE_REPORT_ID report during the registration failure window to cause u1_raw_event() to dereference the freed input2 device, potentially causing a kernel crash.

2972) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98502)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to exhaust kernel resources and potentially cause a denial of service.

The vulnerability exists due to missing resource release in the Linux kernel ALPS HID driver when removing a device. The separately allocated and registered DualPoint Stick input device is not tracked in hdev->inputs and is never unregistered by the default removal path. A local user can repeatedly trigger removal of affected devices to accumulate leaked input devices and potentially exhaust kernel resources.

2973) Use-after-free (CVE-ID: CVE-2026-98503)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially corrupt packet data or cause a denial of service.

The vulnerability exists due to premature release of transmit-ring slots in the Linux kernel packet socket transmit path when skb_orphan invokes a packet buffer's destructor while the buffer still references ring-slot payload data. A local user can exercise the TX_RING transmission path to trigger reuse of a slot still referenced by an in-flight packet, potentially corrupting packet data or causing a denial of service.

2974) NULL pointer dereference (CVE-ID: CVE-2026-98504)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through an early boot hang.

The vulnerability exists due to a null pointer dereference in the Linux kernel functions of_pci_prop_bus_range() and of_pci_prop_intr_map() when generating device tree properties for a PCI bridge without an allocated subordinate bus. A local user can exploit this condition during PCI initialization to cause an early boot hang.

The issue requires CONFIG_PCI_DYNAMIC_OF_NODES to be enabled.

2975) Race condition (CVE-ID: CVE-2026-98505)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause hardware-updated page table state, including dirty bits, to be lost.

The vulnerability exists due to a race condition in damon_hugetlb_mkold() in mm/damon/vaddr.c when clearing the accessed bit in a huge page table entry while hardware updates the same entry. A local user can potentially cause memory writes to overlap with this operation, allowing the function to overwrite hardware-updated dirty bits with a stale page table entry.

2976) Use-after-free (CVE-ID: CVE-2026-98506)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory, potentially causing a denial of service.

The vulnerability exists due to improper folio lifetime management in dissolve_free_hugetlb_folio() in mm/hugetlb.c when dissolving gigantic pages without runtime support. A local user can trigger affected dissolution operations to free a folio that remains on the free list; if vmemmap restoration fails, the add_hugetlb_folio() rollback corrupts that list, potentially causing a kernel crash.

2977) Use-after-free (CVE-ID: CVE-2026-98507)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by leaving tasks indefinitely blocked on anonymous memory locks.

The vulnerability exists due to use-after-free caused by a missing memory barrier in __anon_vma_prepare() in mm/rmap.c when publishing an anon_vma during concurrent page faults. A local user can trigger concurrent faults on compatible adjacent memory mappings to cause a stale anon_vma->root pointer to be used, resulting in locking and unlocking different locks and leaving tasks blocked.

The adjacent virtual memory areas must be unmerged but anon_vma-compatible, for example because they differ in access flags that can be changed with mprotect().

2978) NULL pointer dereference (CVE-ID: CVE-2026-98508)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel fault.

The vulnerability exists due to a null pointer dereference in the Linux kernel virtio GPU driver's submission handling when fence allocation fails under memory pressure. A local user can submit GPU work through the driver's ioctl interface to trigger a path where virtio_gpu_init_submit() passes an unchecked NULL allocation result to virtio_gpu_fence_event_create(), causing a kernel fault and a denial of service.

2979) Memory leak (CVE-ID: CVE-2026-98509)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak kernel memory and potentially cause a denial of service through memory exhaustion.

The vulnerability exists due to a memory leak in the Linux kernel virtio GPU driver's execbuffer error handling when a submission fails after reserving a DRM event for a ring with userspace polling enabled. A local user can repeatedly submit execbuffer requests with invalid buffer handles or input sync objects without fences to leave event allocations permanently orphaned and potentially exhaust kernel memory.

2980) Improper update of reference count (CVE-ID: CVE-2026-98511)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning during buffer-object release.

The vulnerability exists due to incorrect pin-count accounting in the nouveau driver's buffer-object pinning logic when processing a re-pin request for an already pinned buffer object in an incompatible memory domain. A local user can trigger a failed re-pin request that nevertheless increments the pin count, leaving an unmatched pin that triggers a warning in ttm_bo_release() when the buffer object is released.

2981) Use-after-free (CVE-ID: CVE-2026-98512)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering a read of freed kernel memory.

The vulnerability exists due to use-after-free in the Linux kernel nouveau scheduler when retrieving timeline information for a finished fence after its scheduler has been destroyed. A local user can query an exported fence through SYNC_IOC_FILE_INFO to trigger drm_sched_fence_get_timeline_name() to dereference freed scheduler memory, potentially causing a kernel crash.

2982) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98513)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to keep the graphics device powered on unnecessarily, increasing power consumption.

The vulnerability exists due to a missing release of a runtime power-management reference in the Linux kernel nouveau driver's nouveau_connector_detect() function when EDID retrieval fails. A local user can trigger a failure in nvif_outp_edid_get() during connector detection to keep the device powered on until the next successful detection.

2983) Memory leak (CVE-ID: CVE-2026-98514)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to exhaust kernel resources, potentially causing a denial of service.

The vulnerability exists due to an unreleased GEM object reference in the Linux kernel nouveau driver's validate_init() function when ttm_bo_reserve() fails or a virtual memory area lookup returns no matching entry. A local user can trigger these error paths repeatedly to accumulate unreleased objects and potentially exhaust kernel resources, causing a denial of service.

2984) Double free (CVE-ID: CVE-2026-98515)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through kernel memory corruption.

The vulnerability exists due to a double-free in the nouveau driver's nvif_vmm_dtor() function when handling client initialization failure while opening a DRM device. A local user can trigger the affected failure path to cause repeated cleanup calls that free the same vmm->page allocation twice, corrupting kernel memory and potentially causing a denial of service.

2985) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98516)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a resource leak that may degrade system availability.

The vulnerability exists due to a missing release of a PCI device reference in the nouveau driver's nv1a_ram_new() function when reading the memory size from the PCI bridge's configuration space. A local user can potentially trigger the affected initialization path to leave the bridge reference unreleased, which may retain resources and degrade system availability.

2986) Use-after-free (CVE-ID: CVE-2026-98517)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service.

The vulnerability exists due to a use-after-free in the Linux kernel Nouveau driver's nouveau_uvmm_sm() mapping path when a buffer object in TTM_PL_SYSTEM has its struct ttm_resource incorrectly treated as struct nouveau_mem. A local user can trigger mapping operations involving such a buffer object to cause a read beyond the resource allocation, potentially causing a kernel crash.

2987) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98519)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to keep the GPU awake and increase power consumption by preventing runtime suspension.

The vulnerability exists due to a missing release of a runtime power management reference in amdgpu_debugfs_test_ib_show() when acquisition of the reset domain semaphore's write lock is interrupted. A local privileged user can invoke the debugfs test operation and interrupt its lock acquisition to leave the runtime power management reference held, preventing the GPU from entering runtime suspension.

2988) Infinite loop (CVE-ID: CVE-2026-98521)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through an endless loop in the Linux kernel's i915 graphics driver.

The vulnerability exists due to incorrect RCU teardown ordering in the i915 GEM object lifecycle when a GEM object is destroyed concurrently with fence iteration in i915_gem_busy_ioctl. A local user can trigger concurrent object destruction and fence iteration to cause a denial of service, as prematurely released fence references cause the iterator to restart indefinitely without a replacement fence list.

2989) NULL pointer dereference (CVE-ID: CVE-2026-98522)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel NULL pointer dereference.

The vulnerability exists due to incorrect propagation of mapping errors in the Linux kernel Imagination GPU driver's pvr_mmu_map_sgl() function when handling GPU memory mapping failures. A local user can trigger a mapping operation that fails to cause pvr_mmu_map() to continue processing instead of returning an error, leading to a NULL pointer dereference and kernel crash.

2990) Use-after-free (CVE-ID: CVE-2026-98524)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the affected system.

The vulnerability exists due to use-after-free in the Linux kernel RDS InfiniBand memory-region handling code when a failed mapping or registration leaves a freed scatterlist referenced by a pooled memory region. A local user can trigger this failure condition and subsequent memory-region teardown to access freed memory, potentially escalating privileges.

2991) Incorrect authorization (CVE-ID: CVE-2026-98525)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to use and consume another socket's preallocated MCTP tag within the same network namespace.

The vulnerability exists due to improper authorization in mctp_lookup_prealloc_tag() in net/mctp/route.c when processing packets sent with MCTP_TAG_PREALLOC set. A local user can send a packet from a different MCTP socket in the same network namespace with matching network ID, requested tag, and peer address to use and consume a manually allocated tag belonging to another socket because the namespace-wide lookup does not verify socket ownership.

2992) Incorrect Calculation of Buffer Size (CVE-ID: CVE-2026-98526)

CWE-ID: CWE-131 - Incorrect Calculation of Buffer Size

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to potentially cause a denial of service by triggering a kernel socket-buffer headroom underflow.

The vulnerability exists due to insufficient link-layer headroom allocation in llc_alloc_frame() when allocating LLC response frames for stacked Ethernet devices such as VLAN devices. A remote attacker on the local network can send LLC traffic that elicits a response through an affected device to trigger a headroom underflow in eth_header() and potentially cause a denial of service.

2993) Improper update of reference count (CVE-ID: CVE-2026-98527)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to prevent the Zynq GPIO controller from entering runtime suspend, leaving its clock enabled.

The vulnerability exists due to failure to release a runtime power management reference in zynq_gpio_request() when pm_runtime_get_sync() fails during a GPIO request. A local user can trigger a GPIO request that encounters this failure to leave the usage counter incremented and prevent the controller from entering runtime suspend.

2994) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98529)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to interfere with runtime power management, potentially preventing a parent device from entering runtime suspend.

The vulnerability exists due to a missing runtime power-management reference release in arizona_gpio_direction_out() in the Linux kernel's Arizona GPIO driver when a register update fails while switching a persistent GPIO line from input to output. A local user can initiate this direction change and, if regmap_update_bits() fails, leave an outstanding reference that may prevent the parent device from entering runtime suspend.

2995) Out-of-bounds read (CVE-ID: CVE-2026-98531)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disclose uninitialized kernel heap memory.

The vulnerability exists due to an out-of-bounds read in the Linux kernel IPv6 segment routing Generic Netlink interface when processing a SEG6_ATTR_DST attribute shorter than an IPv6 address. A local privileged user can send a SEG6_CMD_SET_TUNSRC message containing a zero-length SEG6_ATTR_DST attribute, followed by SEG6_CMD_GET_TUNSRC, to disclose 16 bytes of uninitialized kernel heap memory because the attribute policy enforces only a maximum length while seg6_genl_set_tunsrc() copies a full 16-byte address.

2996) Out-of-bounds write (CVE-ID: CVE-2026-98532)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory and potentially cause a denial of service.

The vulnerability exists due to out-of-bounds memory access in the Linux kernel's ipv6_find_hdr() function when processing IPv6 extension headers whose declared lengths exceed the remaining packet data. A local user can submit a specially crafted IPv6 packet for processing through Open vSwitch to cause update_ipv6_checksum() to read and write a transport checksum field outside the packet buffer, corrupting kernel memory and potentially causing a kernel crash.

2997) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98535)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a clock reference leak that may contribute to resource exhaustion.

The vulnerability exists due to failure to release a clock reference in the read_dts_node() function of the Freescale FMan Ethernet driver when reading a clock rate during device-tree processing. A local privileged user can trigger the affected processing path to leave an incremented clock reference unreleased, potentially contributing to resource exhaustion.

2998) Resource exhaustion (CVE-ID: CVE-2026-98536)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through prolonged task stalls and a possible kernel panic.

The vulnerability exists due to failure to report Tasks-RCU quiescent states in cleanup_offline_cgwbs_workfn() when draining offline cgroup writeback domains on kernels where cond_resched() is disabled by the preemption configuration. A local user can cause prolonged draining of a writeback domain with many attached inodes to delay concurrent BPF or ftrace detach operations, blocking tasks and potentially triggering a kernel panic.

2999) NULL pointer dereference (CVE-ID: CVE-2026-98537)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering a kernel NULL pointer dereference.

The vulnerability exists due to a NULL pointer dereference in the Linux kernel workqueue function check_flush_dependency() when checking flush dependencies for a worker that is not executing a work item. A local user can potentially trigger this condition during worker creation when memory allocation invokes an out-of-memory notifier, causing the function to dereference worker->current_pwq while it is NULL and potentially cause a denial of service.

3000) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-98538)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through excessive CPU consumption and soft lockups.

The vulnerability exists due to inefficient algorithmic complexity in cleanup_offline_cgwb() in fs/fs-writeback.c when draining inode lists associated with a dying cgroup writeback instance. A local user can trigger cleanup involving a large number of attached inodes to cause repeated rescanning under wb->list_lock, resulting in quadratic processing time and CPU soft lockups.

3001) Race condition (CVE-ID: CVE-2026-98539)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by indefinitely blocking operations on an NTFS3 directory.

The vulnerability exists due to a race condition in ntfs_create_inode() in the Linux kernel NTFS3 filesystem when exposing a new directory inode before its lock initialization is complete. A local user can race directory creation with a path lookup or mount operation to reset an inode lock while it is held, corrupt its state, and cause subsequent directory locking operations to block indefinitely.

3002) Memory leak (CVE-ID: CVE-2026-98541)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to exhaust kernel memory and cause a denial of service.

The vulnerability exists due to a failure to release packet buffers in the Linux kernel FOU receive handler when a direct encapsulation socket has a zero protocol value. A local privileged user can submit a FOU_CMD_ADD Generic Netlink request with FOU_ATTR_TYPE set to FOU_ENCAP_DIRECT while omitting FOU_ATTR_IPPROTO, then send UDP packets to the resulting socket to leak an sk_buff for each received packet and potentially exhaust kernel memory.

3003) Use-after-free (CVE-ID: CVE-2026-98544)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service by crashing the kernel.

The vulnerability exists due to use-after-free in the Linux kernel bna Ethernet driver when tearing down a device or cleaning up a failed probe. A local privileged user can potentially exploit mutually rearming IOC timers to cause bnad_iocpf_timeout() to access bnad->bna_lock after free_netdev() has freed the containing struct bnad, potentially crashing the kernel.

3004) Out-of-bounds write (CVE-ID: CVE-2026-98545)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to system to corrupt kernel memory and potentially cause a denial of service.

The vulnerability exists due to out-of-bounds reads and writes in ata_scsi_set_passthru_sense_fields() in the Linux kernel's libata-scsi component when processing a device's REQUEST SENSE reply after a failed ATA PASS-THROUGH command to an ATAPI device. An attacker with physical access to system can supply a crafted reply through a controlled ATAPI device, manipulating the additional length byte or descriptor layout to trigger accesses beyond the 96-byte sense buffer and potentially crash the kernel.

3005) Integer overflow (CVE-ID: CVE-2026-98547)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by exhausting CPU resources.

The vulnerability exists due to integer overflow in the Linux kernel's prb_calc_retire_blk_tmo() function when calculating the block retirement timeout for TPACKET_V3 packet rings. A local user can use CAP_NET_RAW privileges to configure a packet ring with a specially crafted block size, causing a negative timeout that makes the retirement timer repeatedly fire at the maximum rate and consume CPU resources.

The demonstrated trigger requires a 1 Gbps NIC; QEMU e1000 is a working example.

3006) Use-after-free (CVE-ID: CVE-2026-98548)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service through kernel memory corruption.

The vulnerability exists due to a use-after-free in the Linux kernel SCTP implementation when processing a bundled stale-cookie ERROR chunk and DATA chunk received from a non-primary peer address while an association is in the COOKIE-ECHOED state. A remote attacker can send this crafted packet as an SCTP peer to leave the association referencing a freed transport object, which a subsequent FWD-TSN chunk or delayed SACK timer can cause the kernel to access, potentially resulting in memory corruption and a denial of service.

3007) Cleartext transmission of sensitive information (CVE-ID: CVE-2026-98549)

CWE-ID: CWE-319 - Cleartext Transmission of Sensitive Information

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose transmitted data or cause a denial of service under affected device-encryption conditions.

The vulnerability exists due to improper enforcement of encryption boundaries in Linux kernel TCP buffer collapsing when retransmission or SACK shifting merges buffers queued before and after a switch to device encryption. A remote attacker can exploit this cross-boundary merging to cause PSP data to be retransmitted in cleartext or TLS device-offloaded connections to stall.

The vulnerable condition occurs when the write queue is empty at the encryption switch while earlier, unacknowledged buffers remain in the retransmission queue.

3008) Improper synchronization (CVE-ID: CVE-2026-98550)

CWE-ID: CWE-662 - Improper Synchronization

CVSSv4: 2.3 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to potentially cause a denial of service by leaving a TIPC group socket blocked after a group member departs.

The vulnerability exists due to improper synchronization in tipc_group_delete_member() when a departing member causes the outstanding broadcast acknowledgment counter to reach zero without restoring the group's open state or triggering a socket wakeup. A remote attacker on the local network can potentially cause a member departure under this condition to leave socket operations blocked despite completion of the outstanding acknowledgment accounting.

3009) Integer underflow (CVE-ID: CVE-2026-98550)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to cause a denial of service by blocking future TIPC group broadcasts on an affected socket.

The vulnerability exists due to integer underflow caused by incomplete acknowledgment validation in tipc_group_proto_rcv() when processing TIPC group acknowledgment messages. A remote attacker on the local network can send unexpected or incorrectly sequenced GRP_ACK_MSG messages to decrement the broadcast acknowledgment counter improperly, potentially wrapping it to 65535 and causing persistent congestion on the affected socket.

3010) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98553)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through kernel resource exhaustion.

The vulnerability exists due to missing release of a pipe file reference in the Linux kernel autofs subsystem when mount setup fails or is abandoned before AUTOFS_SBI_CATATONIC is cleared. A local privileged user can trigger repeated unsuccessful mount setup operations to accumulate leaked file references and potentially exhaust kernel resources. During cleanup, autofs_kill_sb() calls autofs_catatonic_mode(), which returns early because the flag remains set, leaving the sbi->pipe reference unreleased.

3011) Incorrect Calculation of Buffer Size (CVE-ID: CVE-2026-98554)

CWE-ID: CWE-131 - Incorrect Calculation of Buffer Size

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel panic.

The vulnerability exists due to insufficient packet buffer headroom in vlan_dev_hard_header() when constructing VLAN headers with VLAN_FLAG_REORDER_HDR unset. A local user can trigger packet transmission using buffers with insufficient reserved headroom to cause an skb_under_panic() kernel panic.

3012) Use-after-free (CVE-ID: CVE-2026-98555)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through kernel memory corruption or memory exhaustion.

The vulnerability exists due to use-after-free, double-free, and memory leaks in the Linux kernel LLC subsystem when llc_mac_hdr_init() fails during packet handling. A local user can trigger the affected error-handling paths to potentially cause a kernel crash or exhaust kernel memory through leaked packet buffers.

3013) Use-after-free (CVE-ID: CVE-2026-98559)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through invalid kernel memory access.

The vulnerability exists due to use-after-free in the Linux kernel SMC function smcr_port_err() when traversing smc_lgr_list.list without holding smc_lgr_list.lock. A local user can potentially trigger a race between this traversal and concurrent smc_lgr_terminate_sched() execution to cause a denial of service by dereferencing a freed link group.

3014) Race condition (CVE-ID: CVE-2026-98561)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through a kernel crash.

The vulnerability exists due to a race condition in the nfp_net_ipsec_rx() function of the Linux kernel's Netronome NFP driver when receiving IPsec packets concurrently with state deletion. A local user can trigger overlapping receive processing and state deletion to cause reference acquisition on an xfrm_state whose reference count has already reached zero, potentially causing a kernel crash.

3015) NULL pointer dereference (CVE-ID: CVE-2026-98565)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering a kernel NULL pointer dereference.

The vulnerability exists due to a null pointer dereference in mt7530_remove() in drivers/net/dsa/mt7530-mdio.c when removing or unbinding an MT7621 or MT7531 switch device. A local privileged user can unload the driver module or trigger a sysfs unbind to cause regulator_disable() to operate on uninitialized core or I/O supply pointers and crash the kernel.

3016) Out-of-bounds write (CVE-ID: CVE-2026-98566)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially corrupt kernel memory or cause a denial of service.

The vulnerability exists due to missing array bounds checks in the Linux kernel's pvr_free_list_process_reconstruct_req() function when processing firmware freelist reconstruction requests. A local user can potentially trigger processing of an oversized freelist count to cause out-of-bounds reads from the fixed request array and out-of-bounds writes to the fixed response array, potentially corrupting kernel memory or causing a denial of service.

3017) Out-of-bounds write (CVE-ID: CVE-2026-98567)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to corrupt kernel memory and potentially cause a denial of service.

The vulnerability exists due to an out-of-bounds write in __netif_set_xps_queue() when updating transmit packet steering (XPS) mappings after reducing the number of traffic classes. A local privileged user can trigger an XPS mapping update for a transmit queue whose stale traffic class is outside the current valid range to write beyond the allocated mapping array and potentially cause a kernel crash.

3018) Out-of-bounds write (CVE-ID: CVE-2026-98568)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to corrupt kernel memory and potentially cause a denial of service.

The vulnerability exists due to an out-of-bounds write caused by a time-of-check to time-of-use race in the Linux kernel VXLAN function vxlan_na_create() when allocating and reserving headroom for neighbour replies. A local privileged user can trigger neighbour reply generation concurrently with link headroom changes through vxlan_changelink() to cause an Ethernet header write beyond the allocated socket buffer, potentially causing a denial of service.

3019) Improper input validation (CVE-ID: CVE-2026-98569)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by disrupting metadata receive lookup for GRE, GRETAP, or ERSPAN tunnel devices.

The vulnerability exists due to missing validation of metadata tunnel uniqueness in ipgre_netlink_parms() when enabling collect_md on an existing tunnel device through changelink. A local privileged user can convert a non-metadata device to metadata mode, replacing another device's metadata receive entry of the same type in the same network namespace, and then delete either device to disrupt metadata receive lookup for the surviving device.

3020) Incorrect comparison (CVE-ID: CVE-2026-98572)

CWE-ID: CWE-697 - Incorrect Comparison

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect BPF comparison results and unintended BPF program control flow on MIPS32 systems.

The vulnerability exists due to incorrect instruction emission in the Linux kernel MIPS32 BPF JIT compiler when compiling immediate JMP JEQ/JNE comparisons with negative operands. A local user can trigger execution of BPF code containing these comparisons to cause incorrect branch decisions because an addu instruction interprets the value 1 as register $at rather than as an immediate constant.

3021) Integer underflow (CVE-ID: CVE-2026-98573)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption that may result in a denial of service.

The vulnerability exists due to an unsigned integer underflow in skb_maybe_pull_tail(), called by skb_checksum_setup_ipv6(), when parsing IPv6 extension headers. A remote attacker can supply crafted IPv6 packet data to trigger subtraction of skb_headlen(skb) from a smaller max value, producing a negative delta after conversion to a signed integer. This delta reaches skb_copy_bits() through __pskb_pull_tail(), where it can become a very large copy length and potentially cause memory corruption and a kernel crash.

The triggering condition requires an skb whose linear area exceeds MAX_IPV6_HDR_LEN and parsing that needs data beyond that linear area.

3022) Out-of-bounds read (CVE-ID: CVE-2026-98575)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to system to trigger an out-of-bounds kernel memory read that may cause a denial of service.

The vulnerability exists due to an out-of-bounds read in pn533_acr122_is_rx_frame_valid() when validating USB response frames from an ACR122 device. An attacker with physical access to system can supply a crafted USB response through a malicious device with an unchecked frame->ccid.datalen value to read beyond the received buffer and potentially crash the kernel.

3023) Out-of-bounds read (CVE-ID: CVE-2026-98576)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially disclose kernel memory contents through debug output.

The vulnerability exists due to an out-of-bounds read in the Linux kernel NFC LLCP functions nfc_llcp_wks_sap() and nfc_llcp_build_sdreq_tlv() when logging non-null-terminated service names. A local user can supply a non-null-terminated service name that is passed to pr_debug() with the %s format specifier to trigger reads beyond the allocated buffer and potentially expose adjacent kernel memory in debug output.

3024) Partial String Comparison (CVE-ID: CVE-2026-98577)

CWE-ID: CWE-187 - Partial String Comparison

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to hijack well-known service access points in the Linux kernel NFC subsystem.

The vulnerability exists due to a partial string comparison in nfc_llcp_wks_sap() when resolving NFC logical link control service names. A local user can supply a short service name such as "u" that matches the prefix of "urn:nfc:sn:snep" to obtain the service access point associated with the longer well-known service name.

3025) Out-of-bounds read (CVE-ID: CVE-2026-98578)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to trigger an out-of-bounds read that may cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the Linux kernel's st21nfca_get_iso15693_inventory() helper when processing truncated ISO15693 inventory responses. A remote attacker on the local network can supply an inventory response with an insufficient length to trigger a read of data[1] as the DSFID beyond the available data, potentially causing a denial of service.

3026) Memory leak (CVE-ID: CVE-2026-98579)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak kernel memory, potentially causing a denial of service through memory exhaustion.

The vulnerability exists due to missing deallocation of queued TLV nodes in the Linux kernel NFC LLCP function nfc_genl_llc_sdreq() when nested netlink attribute parsing, TLV allocation, or service discovery request transmission fails. A local user can repeatedly submit requests that trigger these error paths after TLV nodes have been queued to leak kernel memory and potentially exhaust available memory.

3027) Use-after-free (CVE-ID: CVE-2026-98580)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by potentially crashing the Linux kernel.

The vulnerability exists due to improper synchronization in the Linux kernel NFC LLCP accept queue lifecycle when socket release and accept operations run concurrently. A local user can trigger overlapping operations that unlink and release the same child socket, causing use-after-free or a NULL pointer dereference in nfc_llcp_accept_unlink() that may crash the kernel.

3028) Improper locking (CVE-ID: CVE-2026-98581)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by exhausting kernel memory through unbounded socket leaks.

The vulnerability exists due to improper locking and inconsistent socket list membership in the Linux kernel NFC LLCP nfc_llcp_recv_dm() function when handling DM(NOBOUND) or DM(REJ) messages. A local user can race socket release against concurrent connection operations while a remote peer supplies these messages over an established LLCP link to corrupt the connecting socket list, disrupt reference counting, and leak kernel sockets until memory is exhausted.

3029) Out-of-bounds read (CVE-ID: CVE-2026-98582)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to trigger out-of-bounds reads that may cause a denial of service.

The vulnerability exists due to out-of-bounds reads in the Linux kernel's st21nfca_hci_i2c_repack() function when processing malformed received frames. A remote attacker on the local network can supply a frame with an EOF marker immediately after the start marker or a trailing escape marker to cause CRC processing or byte unstuffing to read beyond the received frame boundary, potentially causing a kernel crash.

3030) Out-of-bounds read (CVE-ID: CVE-2026-98583)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds read that may cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the nfcmrvl firmware download receive path when processing a short helper command frame. A local user can supply a truncated frame to cause the kernel to remove the NCI data header and read the helper command before validating the packet length, potentially causing a kernel fault and denial of service.

3031) Use-after-free (CVE-ID: CVE-2026-98586)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially cause a denial of service.

The vulnerability exists due to use-after-free in the Linux kernel SCTP implementation when timer rearming races with timer cleanup. A remote attacker can potentially trigger this race during SCTP processing, causing a timer handler to access a freed association or transport object and underflow its reference count, which may result in a denial of service.

3032) Out-of-bounds write (CVE-ID: CVE-2026-98588)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to corrupt kernel memory or cause a denial of service.

The vulnerability exists due to an out-of-bounds write in sock_map_free() when freeing a SOCKMAP whose entry count exceeds the range of its signed integer iterator. A local privileged user can create and destroy a SOCKMAP with max_entries = 0xffffffff to trigger signed integer overflow and write outside the socket array, corrupting an unrelated allocation or crashing the kernel.

Exploitation requires the 32 GiB allocation to succeed on a large-memory host.

3033) Unexpected Sign Extension (CVE-ID: CVE-2026-98590)

CWE-ID: CWE-194 - Unexpected Sign Extension

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass BPF verifier assumptions about the range of runtime register values.

The vulnerability exists due to unexpected sign extension and incorrect destination-size accounting in bpf_sock context access code generation when processing access to the rx_queue_mapping field. A local user can execute a specially crafted BPF program that right-shifts the sign-extended value to produce a runtime value outside the bounds assumed by the verifier.

3034) Integer underflow (CVE-ID: CVE-2026-98591)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause invalid kernel memory access, potentially resulting in a denial of service.

The vulnerability exists due to an unsigned integer underflow in skb_pointer_if_linear() when checking whether a memory range used by an skb-backed BPF dynptr lies within the skb linear area. A local user can trigger the bounds check with an out-of-bounds offset to cause it to incorrectly accept the range and return an invalid backing pointer, potentially resulting in a denial of service when that pointer is accessed.

3035) NULL pointer dereference (CVE-ID: CVE-2026-98593)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a potential kernel crash.

The vulnerability exists due to a NULL pointer dereference in the Linux kernel s390 debug_info_copy() function when copying a debug area after debug_register_static() fails and clears its pointers without resetting its bounds. A local user can trigger copying of the affected area by opening its view file or through debug_dump() to cause a denial of service.

3036) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98594)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through unreleased kernel driver resources.

The vulnerability exists due to missing release of PHYLIB resources in the Linux kernel tg3 driver's initialization error path when device probing fails after an MDIO bus has been registered and a PHY connected. A local privileged user can potentially trigger this failure path to leave those resources associated with released mappings and network-device state, which may disrupt system operation.

3037) Out-of-bounds read (CVE-ID: CVE-2026-98597)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds read that may disclose kernel memory or cause a denial of service.

The vulnerability exists due to incorrect receive-length validation in the Linux kernel's sr9700_rx_fixup() function when processing receive buffers. A local user can supply receive data with an inconsistent reported packet length to cause a copy to read beyond the receive buffer, because the length check does not account for the three-byte header and four-byte Ethernet CRC.

3038) Out-of-bounds read (CVE-ID: CVE-2026-98602)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose kernel heap information.

The vulnerability exists due to an out-of-bounds read in Bluetooth BNEP transmit processing when handling AF_PACKET frames shorter than the 14-byte Ethernet header. A local user can submit a specially crafted short frame to cause Ethernet header processing to read beyond the available packet data and disclose kernel heap information.

3039) Out-of-bounds read (CVE-ID: CVE-2026-98602)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to potentially cause a denial of service through out-of-bounds reads in the Linux kernel.

The vulnerability exists due to out-of-bounds reads in Bluetooth BNEP receive-frame and control processing when handling truncated frames or control frames that fall through to Ethernet frame submission. A remote attacker on the local network can send specially crafted BNEP frames to trigger reads beyond available packet data, potentially causing a kernel crash.

3040) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-98605)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service.

The vulnerability exists due to improper resource lifetime management in the Linux kernel samsung-dsim driver's TE GPIO handling when registering and unregistering the TE interrupt during DSI host attachment and detachment. A local user can potentially trigger conflicting manual and device-managed releases of the GPIO descriptor to disrupt driver operation and cause a denial of service.

3041) Use-after-free (CVE-ID: CVE-2026-98606)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger invalid kernel memory accesses and potentially cause a denial of service.

The vulnerability exists due to use-after-free in virtio_gpu_vram_create() in the Linux kernel virtio GPU driver when handling object creation failures. A local user can trigger an error path that frees a GEM object without removing its registered VMA offset node, causing subsequent offset lookups or insertions to access freed memory and potentially crash the system.

3042) Memory leak (CVE-ID: CVE-2026-98607)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to exhaust resources and potentially cause a denial of service.

The vulnerability exists due to improper release of object references in virtio_gpu_resource_create_blob_ioctl() when UUID assignment or GEM handle creation fails. A local user can invoke resource-creation operations that encounter these error paths to leak virtio_gpu_object allocations, resource identifiers, and host-side resources, potentially causing resource exhaustion and a denial of service.

3043) Memory leak (CVE-ID: CVE-2026-98608)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to exhaust resources and potentially cause a denial of service.

The vulnerability exists due to failure to release an owned object reference in virtio_gpu_resource_create_ioctl() when handling a drm_gem_handle_create() failure. A local user can exercise this error path to leak the GPU object, its pages and scatter-gather table, the resource identifier, and the host-side resource, potentially exhausting resources and causing a denial of service.

3044) Memory leak (CVE-ID: CVE-2026-98609)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak guest memory and host-side graphics resources, potentially causing a denial of service through resource exhaustion.

The vulnerability exists due to improper reference-count management in virtio_gpu_gem_create() when graphics handle creation fails. A local user can trigger object creation operations that encounter drm_gem_handle_create() failures to leave graphics objects allocated without a remaining reference, leaking guest memory and host-side resources and potentially causing a denial of service.

3045) Infinite loop (CVE-ID: CVE-2026-98610)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering an infinite packet-classification loop and a CPU soft lockup in the Linux kernel.

The vulnerability exists due to an infinite loop in hfsc_classify() in net/sched/sch_hfsc.c when class-level changes leave previously valid flowid bindings forming a cycle that bypasses the downward-level check. A local user can configure cyclic HFSC filter bindings and send a single packet through the affected queue to cause packet classification to loop indefinitely with the qdisc lock held and bottom halves disabled.

The required network configuration is reachable by an unprivileged user through unshare -Urn, which provides CAP_NET_ADMIN within the new user and network namespaces.

3046) Out-of-bounds read (CVE-ID: CVE-2026-98612)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to system to potentially cause a denial of service or disclose kernel memory.

The vulnerability exists due to out-of-bounds reads and acceptance of undersized packets in the Linux kernel's catc_rx_done() function when processing USB receive transfers. An attacker with physical access to system can supply malformed packet lengths or truncated transfers to trigger reads beyond the receive buffer or from uninitialized socket-buffer tailroom, potentially causing a kernel crash or memory disclosure.

3047) NULL pointer dereference (CVE-ID: CVE-2026-98614)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially cause a denial of service through a NULL pointer dereference in the Linux kernel's SCTP implementation.

The vulnerability exists due to a missing NULL pointer check in sctp_assoc_update_retran_path() when assigning a replacement retransmission path without an eligible transport. A remote attacker can trigger affected SCTP retransmission-path processing when all remaining transports are SCTP_UNCONFIRMED to leave the retransmission path NULL, potentially causing a NULL pointer dereference during subsequent path use or debug logging.

3048) Infinite loop (CVE-ID: CVE-2026-98614)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service through an infinite loop in the Linux kernel's SCTP implementation.

The vulnerability exists due to an unreachable loop termination condition in sctp_assoc_update_retran_path() when selecting a retransmission path while every remaining transport, including the current retransmission path, is SCTP_UNCONFIRMED. A remote attacker can trigger affected SCTP retransmission-path processing under these conditions to cause the transport-selection loop to run indefinitely.

3049) Incomplete cleanup (CVE-ID: CVE-2026-98620)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service.

The vulnerability exists due to incomplete cleanup in the MediaTek Ethernet driver's mtk_probe() error path when network device registration fails. A local privileged user can potentially trigger this failure path to cause previously registered network devices to be freed without being unregistered, triggering a kernel assertion failure and a denial of service.

3050) Out-of-bounds write (CVE-ID: CVE-2026-98621)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt kernel memory and potentially cause a denial of service.

The vulnerability exists due to an integer underflow leading to an out-of-bounds write in the Linux kernel's GUE REMCSUM processing when the checksum field offset is less than the checksum start offset. A remote attacker can send a specially crafted GUE packet to underflow the checksum offset stored in skb->csum_offset and trigger a two-byte write approximately 64 KiB beyond the destination buffer if the forwarded packet retains CHECKSUM_PARTIAL and reaches a NETIF_F_HW_CSUM driver that trusts this metadata.

3051) Reachable assertion (CVE-ID: CVE-2026-98622)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel panic.

The vulnerability exists due to a reachable warning assertion in tcf_ct_flow_table_add() in net/sched/act_ct.c when flow_offload_alloc() returns NULL during packet processing through a tc action ct commit classifier. A local user can race a conntrack flush against traffic handled by the classifier to trigger a warning on an expected allocation failure and cause a kernel panic.

The kernel panic requires panic_on_warn=1.

3052) Out-of-bounds read (CVE-ID: CVE-2026-98623)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger an out-of-bounds kernel memory read, potentially causing a denial of service.

The vulnerability exists due to an out-of-bounds read in the Nouveau driver's nvkm_clk_ustate_update() function when processing a power-state identifier supplied through the pstate debugfs file. A local privileged user can request an identifier absent from clk->states, including any identifier when the list is empty, to cause the function to dereference the list head as a struct nvkm_pstate after an unsuccessful search, potentially causing a denial of service.

3053) Race condition (CVE-ID: CVE-2026-98624)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel fault.

The vulnerability exists due to a race condition in the Linux kernel nfnetlink_queue component when socket release notifications and queue configuration requests are processed concurrently. A local user can race a socket close() operation against an UNBIND request from another socket using the same portid to trigger concurrent queue destruction and cause a denial of service.

3054) Use-after-free (CVE-ID: CVE-2026-98625)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a use-after-free in the Linux kernel.

The vulnerability exists due to a use-after-free in the netfilter flowtable hardware offload worker when flow destruction overlaps with garbage collection. A local user can potentially trigger a race in which NF_FLOW_HW_DEAD is set before NF_FLOW_HW_PENDING is cleared, allowing garbage collection and an RCU callback to free the flow before the worker resumes accessing it, to cause a denial of service.

3055) Improper input validation (CVE-ID: CVE-2026-98626)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass relocation-target validation and cause unintended replacement of BPF instructions.

The vulnerability exists due to improper validation of relocation targets before instruction poisoning in bpf_core_patch_insn(), shared by libbpf and in-kernel CO-RE, when processing unresolved CO-RE relocations. A local user can supply malformed relocation metadata targeting instructions that are not eligible for relocation to replace jumps, calls, exits, register-source arithmetic, or non-immediate loads instead of triggering a relocation error.

3056) Use of multiple resources with duplicate identifier (CVE-ID: CVE-2026-98629)

CWE-ID: CWE-694 - Use of Multiple Resources with Duplicate Identifier

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disrupt traffic classification and exhaust hash-table identifiers.

The vulnerability exists due to inconsistent identifier mapping in the Linux kernel u32 traffic classifier when allocating and deleting hash tables with explicit handles. A local privileged user can create and delete specially selected manual hash tables to leave identifier entries permanently allocated, remove entries belonging to unrelated live tables, and cause duplicate handles that direct hash-table lookups and TCA_U32_LINK references to the wrong table.

3057) Out-of-bounds read (CVE-ID: CVE-2026-98631)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read out-of-bounds kernel memory, potentially disclosing sensitive information.

The vulnerability exists due to an out-of-bounds read in the Linux kernel's xsk_map_gen_lookup() function when generated lookup code compares a zero-extended 32-bit key against a sign-extended 64-bit bound. A local user can supply an out-of-range lookup key that bypasses the bounds check to read beyond the xsk_map[] array.

Exploitation requires a map with max_entries set to 0x80000000 or higher.

3058) Use-after-free (CVE-ID: CVE-2026-98632)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through a kernel crash.

The vulnerability exists due to a use-after-free in the Bluetooth management mesh transmission cancellation logic when canceling a transmission already queued for synchronous processing. A local privileged user can cancel a queued mesh transmission to free its mesh_tx object while queued work retains a pointer to it, potentially causing a kernel crash when mesh_send_sync or its mesh_send_start_complete callback accesses the freed object.

3059) Integer overflow (CVE-ID: CVE-2026-98634)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disrupt kernel zone bookkeeping and potentially cause a denial of service.

The vulnerability exists due to integer truncation and signed integer overflow in the Linux kernel SCSI zoned-disk handling functions sd_zbc_read_zones() and sd_zbc_report_zones() when processing devices reporting excessive zone counts. A local user can supply a device reporting such counts to cause inconsistent zone bookkeeping and potentially a denial of service, because per-zone resources are sized using a truncated count and the signed zone index can overflow past INT_MAX.

3060) Incorrect Bitwise Shift of Integer (CVE-ID: CVE-2026-98636)

CWE-ID: CWE-1335 - Incorrect Bitwise Shift of Integer

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger undefined kernel behavior that may cause a denial of service.

The vulnerability exists due to an incorrect bitwise shift in the squashfs_xz_comp_opts() function when processing a SquashFS image with the COMP_OPTS flag set to 1 and a dictionary size of zero. A local privileged user can cause a specially crafted image to be mounted to trigger a shift with an exponent of -1, resulting in undefined behavior that may cause a denial of service.

3061) Out-of-bounds read (CVE-ID: CVE-2026-98640)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service through a kernel page fault.

The vulnerability exists due to an out-of-bounds read in the Linux kernel amd_sfh driver's PCI probe code when accessing MMIO registers without validating that PCI BAR 2 covers the required offsets. A local privileged user can trigger probing of a device with an undersized BAR 2 to cause an access beyond the mapped region and a kernel page fault.

3062) Use-after-free (CVE-ID: CVE-2026-98642)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering a kernel use-after-free.

The vulnerability exists due to a use-after-free in the Linux kernel BPF memory allocator when alloc_bulk() consumes list nodes concurrently with RCU Tasks Trace cleanup. A local user can trigger concurrent BPF memory allocation and reclamation operations to potentially crash the kernel by causing access to freed list nodes.

3063) Out-of-bounds read (CVE-ID: CVE-2026-98643)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disclose adjacent kernel memory, including portions of kernel pointers.

The vulnerability exists due to an out-of-bounds read in the Linux kernel BPF sock_ops context conversion code when processing rtt_min access on the tcp_conn_request() path. A local privileged user can use a sockops BPF program that reads skops->rtt_min during BPF_SOCK_OPS_RWND_INIT to disclose adjacent kernel memory because a request_sock is incorrectly treated as a full tcp_sock without checking the socket type.

3064) Excessive Iteration (CVE-ID: CVE-2026-98644)

CWE-ID: CWE-834 - Excessive Iteration

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering prolonged CPU stalls and soft lockups.

The vulnerability exists due to excessive iteration without rescheduling points in __htab_map_lookup_and_delete_batch() when processing BPF hash map batch operations. A local user can invoke batch lookups on a sufficiently large map to cause prolonged CPU stalls, because the batch count limits entries copied rather than buckets visited, and consecutive empty buckets are traversed within a single RCU read-side, instrumentation-disabled critical section.

3065) Improper locking (CVE-ID: CVE-2026-98646)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger kernel warnings and potentially disrupt system stability.

The vulnerability exists due to improper locking in inet_csk_listen_stop() when stopping a TCP listener with children in its accept queue from a BPF TCP iterator. A local privileged user can invoke bpf_sock_destroy() through the iterator to reach cond_resched() while an RCU read-side lock is held, triggering an invalid-context warning and potentially disrupting system stability.

3066) Division by zero (CVE-ID: CVE-2026-98647)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering a kernel divide-by-zero exception.

The vulnerability exists due to an unchecked zero divisor in btf_struct_walk() when validating an access beyond a structure ending in a flexible array whose element type has zero size. A local privileged user can load a specially crafted BPF program that accesses the structure through a PTR_TO_BTF_ID pointer not marked MEM_ALLOC to trigger a modulo-by-zero operation during verification and cause a denial of service.

3067) Incorrect authorization (CVE-ID: CVE-2026-98655)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose kernel instruction addresses and bypass kernel address space layout randomization (KASLR).

The vulnerability exists due to improper authorization in the Linux kernel perf subsystem when processing events that request text-poke records with exclude_kernel=1. A local user can open and mmap a task-local software event with text_poke=1 without kernel perf access to receive raw kernel instruction addresses from text-poke records and, with a known kernel image, determine the runtime kernel text base.

3068) Use-after-free (CVE-ID: CVE-2026-98656)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a potential kernel crash.

The vulnerability exists due to use-after-free in the Linux kernel IIO trigger subsystem when pending reenable_work executes after its owning trigger has been freed by iio_trig_release(). A local user can potentially trigger a race between deferred interrupt work and trigger teardown to cause access to freed kernel memory and crash the system.

3069) Use-after-free (CVE-ID: CVE-2026-98657)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by accessing freed kernel memory.

The vulnerability exists due to a use-after-free in the Linux kernel pulsedlight proximity driver when runtime power management setup fails during device probing. The error handling frees the device structure without unregistering the IIO device, leaving live sysfs and character device nodes pointing to freed memory. A local user can access these stale device nodes to potentially trigger a kernel crash.

3070) Out-of-bounds read (CVE-ID: CVE-2026-98660)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger an out-of-bounds kernel memory read, potentially causing a denial of service.

The vulnerability exists due to an out-of-bounds read in the Linux kernel bmp280 pressure sensor driver's bmp280_write_sampling_frequency() function when looking up a requested sampling frequency. The function treats the number of flattened integer elements as the number of two-element frequency entries. A local privileged user can request a sampling frequency that causes the lookup to iterate beyond the table boundary, potentially causing a kernel fault and a denial of service.

3071) Unchecked Return Value (CVE-ID: CVE-2026-98661)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service in buffered sensor acquisition.

The vulnerability exists due to an unchecked error return value in the Linux kernel ROHM BU27034 light sensor driver's bu27034_buffer_thread() function when reading the sensor integration time fails. A local user can initiate buffered sensor acquisition that encounters this error to cause the error code to be used in calculating the sleep duration, potentially leaving the acquisition thread delayed indefinitely.

3072) Use-after-free (CVE-ID: CVE-2026-98662)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering a kernel use-after-free.

The vulnerability exists due to a use-after-free in the Linux kernel gp2ap020a00f light sensor driver when queued IRQ work executes after device removal has freed the trigger object. A local user can exploit this timing window to cause pending work to call iio_trigger_poll() on the freed object, potentially crashing the kernel.

3073) Use-after-free (CVE-ID: CVE-2026-98663)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service by triggering access to freed kernel memory.

The vulnerability exists due to a use-after-free in the Linux kernel adis16480 driver's debugfs file operations when firmware_revision or firmware_date is read concurrently with device unbinding. A local privileged user can trigger a read that remains in progress during device unbinding, allowing the read operation to access the freed iio_dev structure and potentially crash the kernel.

3074) Use-after-free (CVE-ID: CVE-2026-98664)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through access to freed kernel memory.

The vulnerability exists due to use-after-free in the Linux kernel adis16400 driver's serial_number debugfs read handler when a read overlaps device unbinding. A local privileged user can read the debugfs file concurrently with device unbinding to potentially trigger a kernel crash, because debugfs removal does not wait for the read to finish before the underlying iio_dev is freed.

3075) NULL pointer dereference (CVE-ID: CVE-2026-98665)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a kernel crash.

The vulnerability exists due to a null pointer dereference in max30102_interrupt_handler() in the Linux kernel when an interrupt arrives while no buffer is enabled. A local user can cause the handler to dereference a null active_scan_mask pointer to crash the kernel if able to induce this interrupt condition.

3076) Use-after-free (CVE-ID: CVE-2026-98666)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service by triggering access to freed kernel memory.

The vulnerability exists due to a use-after-free in the Linux kernel adis16136 gyroscope driver's serial_number debugfs file operations when a read overlaps device unbinding. A local privileged user can read this file during device unbinding to trigger access to an iio_dev structure that has already been freed, potentially crashing the kernel.

3077) Use of uninitialized resource (CVE-ID: CVE-2026-98668)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information from kernel heap memory.

The vulnerability exists due to missing initialization of the bounce buffer in iio_push_to_buffers_with_ts_unaligned() when processing data whose length is not a multiple of 8 bytes with timestamps enabled. A local user can read affected IIO buffer output to obtain uninitialized kernel heap data.

3078) Race condition (CVE-ID: CVE-2026-98669)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to invalidate kernel buffer state and potentially cause a denial of service.

The vulnerability exists due to a race condition in the Linux kernel Industrial I/O buffer subsystem when device unregistration disables and deactivates buffers without holding the mlock mutex while a buffer-mode claim is held. A local user can potentially trigger overlapping device unregistration and buffer-mode operations to invalidate buffer state still relied upon by the claim holder, potentially causing a denial of service.

3079) Use-after-free (CVE-ID: CVE-2026-98670)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service by triggering a kernel use-after-free.

The vulnerability exists due to a use-after-free in the Linux kernel Xilinx XADC driver when device unbinding overlaps with alarm interrupt handling. A local privileged user can potentially trigger this race so that the interrupt handler requeues zynq_unmask_work after delayed work has been cancelled, allowing the work to access the freed xadc structure and potentially crash the kernel.

3080) Incomplete cleanup (CVE-ID: CVE-2026-98671)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through incomplete driver cleanup.

The vulnerability exists due to incomplete cleanup in the Linux kernel sun4i-gpadc-iio driver's probe function when thermal zone registration fails with an error other than -ENODEV. A local user can potentially trigger this failure path to leave the IIO map array registered and runtime power management enabled, which may disrupt system operation.

3081) Division by zero (CVE-ID: CVE-2026-98672)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service.

The vulnerability exists due to an unchecked division by zero in the Linux kernel STM32 ADC driver's stm32_adc_read_raw() function when processing a failed conversion or a zero conversion result. A local user can request a processed channel reading that encounters such a conversion result to potentially trigger a kernel fault and cause a denial of service.

3082) Use-after-free (CVE-ID: CVE-2026-98677)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to corrupt kernel memory and potentially cause a denial of service.

The vulnerability exists due to use-after-free in the Linux kernel's ad_sigma_delta ADC driver when device unbinding releases the sample buffer before the trigger handler is detached. A local privileged user can trigger device unbinding while data-ready interrupts remain active to cause ad_sd_trigger_handler() to copy incoming samples into freed memory, potentially crashing the system.

3083) Improper update of reference count (CVE-ID: CVE-2026-98679)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to underflow the runtime power-management usage count and trigger a kernel warning.

The vulnerability exists due to improper runtime power-management reference counting in kxcjk1013_write_event_config() in the Linux kernel's kxcjk-1013 accelerometer driver when processing repeated writes that disable events. A local privileged user can submit duplicate disable requests through the event enable attribute to drop a runtime power-management reference that was not acquired for the request, causing a usage-count underflow and a "Runtime PM usage count underflow" warning.

3084) Memory leak (CVE-ID: CVE-2026-98680)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory leaks and potentially disrupt accelerometer operation.

The vulnerability exists due to missing memory cleanup and incomplete state restoration in the Linux kernel kionix-kx022a accelerometer driver's kx022a_fifo_enable() function when register operations fail during buffer enablement. A local user can attempt to enable buffered sampling under these failure conditions to leak allocated sample memory and potentially leave interrupts, hardware buffers, or driver state flags incorrectly configured.

3085) Race condition (CVE-ID: CVE-2026-98681)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially corrupt SMB client file state by causing concurrent flag updates to be lost.

The vulnerability exists due to a race condition in the Linux kernel SMB client's struct cifsFileInfo when concurrent code paths update flags stored in the same bitfield byte under different locks. A local user can potentially trigger overlapping SMB file operations to cause byte-level read-modify-write operations on one flag to overwrite concurrent changes to another flag, leaving file state inconsistent.

3086) Incomplete cleanup (CVE-ID: CVE-2026-98686)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause cached data written past the end of a file to become visible as file content after the file is extended.

The vulnerability exists due to incomplete page-cache invalidation in the Linux kernel SMB client's smb3_zero_range() function when extending a file through a zero-range operation. A local user can write past the existing end of the file through a memory mapping and extend the file through a zero-range operation to expose retained cached data as file content.

3087) Out-of-bounds read (CVE-ID: CVE-2026-98687)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to read beyond an allocated kernel heap buffer, potentially disclosing sensitive information.

The vulnerability exists due to an out-of-bounds read in the Linux kernel Thunderbolt driver's tb_xdp_properties_request() function when processing XDomain properties responses with oversized header-derived data lengths. A remote attacker on the local network can supply a malicious peer response with the six-bit length field set to 63 to trigger a 192-byte read from a 180-byte data array when data_len is at least 48, potentially exposing 12 bytes of adjacent kernel heap memory.

3088) Use-after-free (CVE-ID: CVE-2026-98694)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service.

The vulnerability exists due to a use-after-free in the Linux kernel Thunderbolt control channel request handling when request completion races with cancellation. A local user can potentially trigger this race during control channel operations to cause a request worker to be scheduled again after its request has been dequeued and freed, potentially resulting in a kernel crash.

3089) Race condition (CVE-ID: CVE-2026-98695)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a kernel NULL-pointer dereference.

The vulnerability exists due to a race condition in the Linux kernel USB serial tty callbacks when ioctl operations overlap with device hangup. A local user can issue tty ioctl operations concurrently with a USB serial device disconnect, including during lengthy break signalling, to trigger access to unavailable driver data or hardware and cause a denial of service.

3090) Use-after-free (CVE-ID: CVE-2026-98696)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service by crashing the kernel.

The vulnerability exists due to use-after-free in USB serial completion handlers when driver deregistration unbinds ports before ongoing I/O has stopped. A local privileged user can potentially trigger overlapping I/O and driver module unloading to cause completion handlers to access freed port data, which may crash the kernel.

3091) Race condition (CVE-ID: CVE-2026-98697)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to leak kernel memory, potentially causing a denial of service through resource exhaustion.

The vulnerability exists due to a race condition in the Linux kernel USB serial subsystem when driver deregistration overlaps with writes to the new_id attribute. A local privileged user can write to the attribute during deregistration to add a dynamic ID that escapes cleanup, leaking its allocated memory.

3092) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-98698)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel failure.

The vulnerability exists due to improper handling of zero-length allocations in mac80211 AES-SIV encryption when processing an association or reassociation request ending with a FILS Session element. A local user can trigger encryption of such a request to cause an invalid page to be placed in a scatterlist, triggering a kernel BUG when CONFIG_DEBUG_SG is enabled and potentially causing a denial of service otherwise.

3093) Use-after-free (CVE-ID: CVE-2026-98699)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through access to freed kernel memory.

The vulnerability exists due to a use-after-free in the Linux kernel mac80211 mesh fast transmit cache when mesh path deletion races with cache entry insertion. A local user can potentially trigger concurrent mesh path deletion and cache insertion to leave a cache entry referencing a freed mesh_path object, which may cause a kernel crash when accessed.

3094) Improper initialization (CVE-ID: CVE-2026-98700)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially disrupt wireless communication through incorrect transmit-rate selection.

The vulnerability exists due to improper initialization of transmit band metadata in the mac80211 ieee80211_8023_xmit() function when processing 802.3 encapsulation offload frames on non-MLD interfaces. A local user can trigger transmission of affected frames to cause transmit-rate selection using an incorrect frequency band, potentially disrupting wireless communication.

3095) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98701)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by exhausting the mesh path quota and preventing new paths to reachable destinations from being created.

The vulnerability exists due to failure to release reserved mesh path slots in the Linux kernel mac80211 mesh_path_add() function when path allocation fails or insertion encounters an error or an existing destination. A local user can trigger repeated failed or duplicate mesh path additions to exhaust MESH_MAX_MPATHS even though the path table contains fewer installed paths, preventing new mesh paths from being created.

3096) Out-of-bounds write (CVE-ID: CVE-2026-98703)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to corrupt kernel memory and potentially cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the Linux kernel mac80211 minstrel_ht rate-control component when processing an invalid fixed rate index supplied through the fixed_rate_idx debugfs file. A local privileged user can write a value such as 65535 to select group 4095 and rate index 15, causing minstrel_ht_set_rate() to access and update rate statistics outside the valid arrays and corrupt adjacent kernel memory.

3097) Use-after-free (CVE-ID: CVE-2026-98704)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to potentially cause a denial of service by triggering access to freed kernel memory during wireless association.

The vulnerability exists due to use-after-free in the Linux kernel mac80211 ieee80211_assoc_config_link() function when associating with a non-transmitted MBSSID profile using an association response that omits WMM, HT, or VHT information. Pointers copied from the fallback parse reference merged-profile storage that is freed before channel, bandwidth, and HT capability configuration finishes. A remote attacker on the local network can supply a specially crafted association response to trigger reads through these dangling pointers and potentially crash the kernel.

3098) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-98705)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to bypass mesh path limits, potentially exhausting kernel memory and causing a denial of service.

The vulnerability exists due to improper resource quota accounting in the Linux kernel mac80211 mesh path management code when creating and removing proxy paths. Proxy-path additions do not increment the shared path counter, but removals decrement it, allowing the counter to become negative. A remote attacker on the local network can induce repeated proxy-path creation and removal to allow subsequent mesh path additions to exceed MESH_MAX_MPATHS and potentially exhaust kernel memory.

3099) Race condition (CVE-ID: CVE-2026-98706)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service.

The vulnerability exists due to a race condition in the mac80211 station teardown and power-save delivery code when removing an AP or mesh station while power-save delivery work is running. A local user can exploit overlapping teardown and delivery operations to cause driver notifications and queue updates after the corresponding station state has been removed or cleaned up, potentially causing a denial of service.

3100) Use-after-free (CVE-ID: CVE-2026-98707)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to cause a denial of service by potentially crashing the Linux kernel.

The vulnerability exists due to use-after-free in mac80211 RX BA session timer handling when an RX BAR handler races with session teardown. A remote attacker on the local network can send RX BAR frames during teardown to cause a stale handler to rearm the session timer, potentially causing subsequent timer processing to access freed memory and crash the kernel.

3101) Use-after-free (CVE-ID: CVE-2026-98708)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering a kernel use-after-free.

The vulnerability exists due to use-after-free in the Linux kernel mac80211 channel-context management code when releasing or reassigning the last assigned link during an in-place channel-context replacement. A local user can trigger these operations while a replacement pairing remains active to leave a stale replace_ctx pointer that subsequent unreserve or switch-finalization operations may dereference, potentially crashing the kernel.

3102) Use-after-free (CVE-ID: CVE-2026-98709)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through a kernel use-after-free.

The vulnerability exists due to use-after-free in the Linux kernel mac80211 function ieee80211_vif_use_reserved_switch() when reservations belonging to different channel-context replacement operations are incorrectly counted toward completion of the current replacement. A local user can potentially trigger channel-context replacement with mismatched reservations to cause premature freeing of a channel context still used by a link and its driver, potentially causing a kernel crash during subsequent beacon generation.

3103) Memory leak (CVE-ID: CVE-2026-98710)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a kernel memory leak that may lead to resource exhaustion and a denial of service.

The vulnerability exists due to missing release of allocated EEPROM memory in il3945_pci_remove() when removing a PCI device after a successful probe. A local privileged user can trigger removal of an affected device to leave its EEPROM allocation unreleased, potentially exhausting kernel memory if the operation is repeated.

3104) Out-of-bounds read (CVE-ID: CVE-2026-98711)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to system to disclose kernel heap data to a malicious wireless device.

The vulnerability exists due to an out-of-bounds read in the Linux kernel cw1200 wireless driver's transmit path when sending frames with bus alignment padding from buffers without sufficient tailroom. An attacker with physical access to system can use a malicious device to collect bytes read past the end of the frame buffer, exposing up to 511 bytes of kernel heap data per transmitted frame over SDIO.

3105) Protection mechanism failure (CVE-ID: CVE-2026-98716)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to interfere with correct handling of model-specific register state in nested virtual machines, potentially weakening isolation between execution contexts.

The vulnerability exists due to incorrect selection of the MSR permission bitmap in KVM's SVM msr_write_intercepted() function when checking MSR write interception while a nested guest is active. A local user can trigger nested guest MSR accesses to cause interception checks to consult vmcb02's bitmap even when it is not the active virtual machine control block's bitmap, potentially resulting in incorrect MSR state handling.

3106) NULL pointer dereference (CVE-ID: CVE-2026-98717)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a kernel NULL pointer dereference.

The vulnerability exists due to a null pointer dereference in the Linux kernel KVM x86 shadow page-table walker when memory-slot creation races with a stage-2 page fault from a nested guest (L2). A local user can trigger this race to cause a shadow page-table walk through a dummy root backed by the zero page, resulting in a kernel crash.

3107) Incorrect authorization (CVE-ID: CVE-2026-98720)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to read and modify the host hypervisor's task priority register from a nested virtual machine.

The vulnerability exists due to incorrect access control caused by a stale MSR bitmap in the Linux kernel's KVM nested VMX implementation when runtime enlightened VMCS controls are modified. A local privileged user can configure an L1 hypervisor not to intercept TPR writes and run the same L2 guest first with TPR virtualization enabled and then disabled to read and write L0's task priority register.

3108) Use of uninitialized resource (CVE-ID: CVE-2026-98721)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service.

The vulnerability exists due to use of uninitialized synchronization resources in the Linux kernel Cadence NAND interrupt handler when a pending interrupt is handled after IRQ registration but before initialization of the IRQ lock and completion object. A local user can potentially exploit this initialization window to disrupt kernel operation and cause a denial of service.

3109) Division by zero (CVE-ID: CVE-2026-98722)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service in the Linux kernel.

The vulnerability exists due to division by zero in the block2mtd driver's add_device() function when processing a zero erase size supplied through the block2mtd module parameter. A local privileged user can set the erase size to zero to trigger a kernel divide error during the device-size modulo calculation and cause a denial of service.

3110) Out-of-bounds write (CVE-ID: CVE-2026-98725)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by triggering a kernel crash.

The vulnerability exists due to an out-of-bounds write in the Linux kernel's nvmet_auth_challenge() function when handling an AUTH_RECEIVE request with a short output buffer. A remote attacker can submit a request with an insufficient response buffer length to bypass a size check that undercounts the fixed challenge header by 15 bytes, causing the challenge to be written beyond the allocated buffer and potentially crashing the kernel.

3111) Integer underflow (CVE-ID: CVE-2026-98726)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger out-of-bounds kernel memory reads, potentially causing a denial of service or disclosing sensitive information.

The vulnerability exists due to integer underflow in the Linux kernel NVMe multipath ANA log parser when processing inconsistent controller-supplied ANA data. A local privileged user can supply malformed ANA data with object sizes exceeding the allocated log buffer to bypass bounds checks and trigger reads beyond ana_log_buf while parsing group descriptors or namespace ID arrays.

3112) Out-of-bounds read (CVE-ID: CVE-2026-98732)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially disclose kernel memory through diagnostic output.

The vulnerability exists due to an out-of-bounds read in btintel_hw_error() in drivers/bluetooth/btintel.c when logging a Bluetooth exception payload that is not NUL-terminated. A local user can trigger logging of such a payload to potentially expose memory beyond its boundary through the unbounded "Exception info %s" format operation.

3113) Use-after-free (CVE-ID: CVE-2026-98733)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory and potentially cause a denial of service.

The vulnerability exists due to a use-after-free in the Linux kernel Bluetooth hci_queue_iso() function when fragmented ISO packets are queued concurrently with transmit worker dequeues without holding the queue lock. A local user can send fragmented ISO packets to trigger a race in which queue insertion writes through a previously freed packet pointer, corrupting kernel memory and potentially causing a denial of service.

3114) Use-after-free (CVE-ID: CVE-2026-98734)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause kernel memory corruption that may result in a denial of service.

The vulnerability exists due to use-after-free in the Linux kernel Bluetooth SCO and ISO schedulers when connection teardown overlaps transmission scheduling. A local user can trigger concurrent connection teardown and transmission scheduling to potentially cause a denial of service by accessing a connection freed after hci_low_sent() releases its RCU read lock.

3115) Use-after-free (CVE-ID: CVE-2026-98735)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a potential kernel crash.

The vulnerability exists due to use-after-free in the Linux kernel Bluetooth ACL and LE transmit schedulers when channel deletion races with channel selection and transmission. A local user can trigger overlapping channel transmission and teardown to cause a denial of service if the transmit path accesses channel memory after it has been freed.

3116) Use-after-free (CVE-ID: CVE-2026-98736)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through a kernel use-after-free.

The vulnerability exists due to use-after-free in the Linux kernel Bluetooth hci_enhanced_setup_sync() function when enhanced SCO setup accesses an ACL parent connection concurrently with its teardown. A local user can trigger overlapping connection setup and disconnection processing to potentially cause a kernel crash by accessing the freed parent connection during capability checks or parameter selection.

3117) Use-after-free (CVE-ID: CVE-2026-98737)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering access to freed Bluetooth inquiry-cache entries.

The vulnerability exists due to use-after-free in the Linux kernel Bluetooth inquiry-cache handling in hci_acl_create_conn_sync() and hci_stop_discovery_sync() when preparing connection or discovery-cancellation commands concurrently with cache updates or flushes. A local user can trigger an HCIINQUIRY ioctl concurrently with these operations to free a cache entry after lookup but before the worker reads its fields, potentially causing a kernel crash.

3118) Use-after-free (CVE-ID: CVE-2026-98738)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service through a kernel crash.

The vulnerability exists due to use-after-free in the Linux kernel Bluetooth build_pairing_cmd() function when accessing remote out-of-band (OOB) data during pairing. A local privileged user can trigger concurrent pairing and remote OOB data removal operations to cause the function to access a freed list entry, potentially crashing the kernel.

3119) Use-after-free (CVE-ID: CVE-2026-98739)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a kernel use-after-free.

The vulnerability exists due to a use-after-free in the Linux kernel Bluetooth RFCOMM TTY component when device installation and release concurrently manage the initial port reference for RFCOMM_RELEASE_ONHUP devices. A local user can trigger overlapping installation and release operations to cause both paths to drop the same initial reference, resulting in access to a freed port and potentially a kernel crash.

3120) Heap-based buffer overflow (CVE-ID: CVE-2026-98741)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to system to corrupt kernel heap memory and cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in the Linux kernel ALSA ua101 USB audio driver when calculating playback write sizes from capture packets without validating the relative endpoint packet sizes and channel counts. An attacker with physical access to system can connect a USB device advertising crafted capture and playback descriptors and induce a user to open its playback PCM node to trigger writes beyond the allocated playback buffer, corrupting kernel memory and causing a denial of service.

3121) Use-after-free (CVE-ID: CVE-2026-98742)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel use-after-free.

The vulnerability exists due to missing synchronization leading to a use-after-free in the ALSA sequencer compatibility port-info ioctl handler when processing concurrent port-creation requests. A local user can issue concurrent compat CREATE_PORT requests to bypass the port-count check, cause port indices to wrap to an existing address, and trigger access to a freed subscriber during subsequent teardown to potentially cause a kernel crash.

3122) Use of Uninitialized Variable (CVE-ID: CVE-2026-98743)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially disrupt audio processing through an incorrectly configured SoundWire stream.

The vulnerability exists due to use of an uninitialized variable in the Linux kernel's rt1017_sdca_pcm_hw_params() function when configuring an audio stream. A local user can trigger stream configuration with an uninitialized stream_config.type value that is passed to sdw_stream_add_slave() and subsequently copied to stream->type by sdw_config_stream(), potentially disrupting audio processing.

3123) Use of Uninitialized Variable (CVE-ID: CVE-2026-98744)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect audio stream configuration, potentially disrupting audio operation.

The vulnerability exists due to use of an uninitialized variable in max98363_sdw_dai_hw_params() in the Linux kernel MAX98363 codec driver when configuring SoundWire audio streams. A local user can trigger stream configuration with an indeterminate stream_config.type value, which is passed to sdw_stream_add_slave() and later copied to stream->type by sdw_config_stream(), potentially disrupting audio operation.

3124) Improper input validation (CVE-ID: CVE-2026-98745)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel panic.

The vulnerability exists due to improper input validation in restore_sve_fpsimd_context() in the Linux kernel arm64 signal-handling code when restoring a user-supplied SVE signal context. A local user can supply a crafted context with SVE_SIG_FLAG_SM clear and an SVE payload present to establish unsupported non-streaming SVE state, causing subsequent state restoration to trigger a fatal kernel undefined-instruction exception.

Exploitation requires an arm64 system that supports SME but does not support SVE.

3125) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98746)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause clock reference leaks that may degrade system availability.

The vulnerability exists due to missing release of clock references in the Linux kernel ma35d1 serial driver when device probing fails or a serial port is removed. A local privileged user can trigger the affected driver lifecycle paths to leave clock references acquired by of_clk_get() unreleased, potentially degrading system availability through repeated resource leakage.

3126) Use-after-free (CVE-ID: CVE-2026-98748)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through access to freed kernel memory.

The vulnerability exists due to use-after-free in the Linux kernel's 8250_bcm7271 serial driver when port removal races with a receive-timeout interrupt while hardware flow control is enabled. A local privileged user can potentially exploit this race to re-arm a timer after its cancellation, causing brcmuart_hrtimer_func() to dereference freed private data and potentially crash the kernel.

3127) Use-after-free (CVE-ID: CVE-2026-98749)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through access to freed kernel memory.

The vulnerability exists due to use-after-free in the Linux kernel MAX3100 serial driver when an SPI device is unbound during system suspend before resume. A local privileged user can trigger this device-removal sequence, if permitted, to leave the polling timer armed after the port is freed, allowing max3100_timeout() to access freed memory and potentially crash the system.

3128) Use-after-free (CVE-ID: CVE-2026-98750)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially corrupt kernel memory or cause a denial of service.

The vulnerability exists due to a use-after-free in the Linux kernel TTY subsystem when closing a TTY and saving its termios settings races with device re-registration that resets saved termios state. A local user can attempt to trigger these concurrent operations for a reused minor number to access freed memory, potentially corrupting kernel memory or causing a denial of service.

3129) Race condition (CVE-ID: CVE-2026-98751)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger driver calls for an unavailable tty device, potentially causing a denial of service.

The vulnerability exists due to a race condition in the Linux kernel tty subsystem's send_break() function when processing timed break ioctls concurrently with a hangup. A local user can issue TCSBRK or TCSBRKP ioctls with a user-controlled timeout to trigger a delayed break_ctl() callback after the device has disappeared or powered down, potentially disrupting system operation if the driver does not safely handle the race.

3130) Use-after-free (CVE-ID: CVE-2026-98752)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a use-after-free or NULL-pointer dereference in the Linux kernel.

The vulnerability exists due to a use-after-free caused by missing synchronization in tty_port_tty_vhangup() and tty_port_hangup() when concurrent hangups overlap with port deregistration and resource teardown. A local user can trigger racing ioctl or hangup operations during teardown to access resources after they have been freed or encounter a NULL-pointer dereference, potentially causing a kernel crash.

3131) Race condition (CVE-ID: CVE-2026-98753)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel panic.

The vulnerability exists due to improper error-state handling in tty_port_open() in drivers/tty/tty_port.c when port activation fails and a TTY ioctl races with hangup and open operations. A local user can trigger this race to cause I/O attempts on a powered-down or deregistered port, leading to a kernel panic through unclocked accesses or NULL-pointer dereferences.

3132) Use-after-free (CVE-ID: CVE-2026-98754)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through a kernel crash.

The vulnerability exists due to a use-after-free in the Linux kernel vcc driver when terminal cleanup races with LDC callback processing. A local user can potentially trigger concurrent vcc_cleanup() and vcc_event() execution, causing a callback to dereference freed memory through tty->port and crash the kernel.

3133) Use of Uninitialized Variable (CVE-ID: CVE-2026-98755)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to obtain potentially sensitive kernel stack data.

The vulnerability exists due to use of an uninitialized stack variable in vcc_send_ctl() in drivers/tty/vcc.c when sending control packets through ldc_write(). A local user can receive control packets as the LDC peer to obtain kernel stack data potentially exposed through the uninitialized tag.stype_env field of the struct vio_vcc packet.

3134) NULL pointer dereference (CVE-ID: CVE-2026-98756)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by crashing the Linux kernel.

The vulnerability exists due to a NULL pointer dereference in the Cadence USBSS driver's cdns3_pci_probe() function when probing the controller's second PCI function after the first function has been enabled but before its driver data has been stored. A local privileged user can potentially trigger this probe timing condition to cause pci_get_drvdata() to return NULL, leading to a kernel crash when the driver assigns wrap->devfn.

3135) Use-after-free (CVE-ID: CVE-2026-98757)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a kernel crash and denial of service.

The vulnerability exists due to a use-after-free in cdns3_gadget_exit() in the Linux kernel USB cdns3 gadget driver when tearing down a gadget device with deferred work still queued. A local user can exploit deferred work accessing freed device memory after teardown to potentially cause a kernel crash and denial of service.

3136) Use-after-free (CVE-ID: CVE-2026-98758)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption that may result in a denial of service through a kernel crash.

The vulnerability exists due to use-after-free in the Linux kernel UCSI GLINK driver when queued work executes after the UCSI instance has been unregistered during device removal. Notification callbacks can continue queuing work before device-managed cleanup releases the pmic_glink client, allowing that work to dereference the freed connector array or register and unregister the instance again. A local user can potentially exploit this removal-time race to access freed kernel state and cause a kernel crash.

3137) Use of Uninitialized Variable (CVE-ID: CVE-2026-98760)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to system to potentially cause a denial of service and disclose kernel stack data.

The vulnerability exists due to use of an uninitialized stack variable in tps6598x_connect() in the Linux kernel USB Type-C tipd driver when registering a port partner. An attacker with physical access to system can connect a USB device to an affected port to trigger the use of uninitialized descriptor fields, potentially causing a kernel crash through invalid callback invocation and exposing stack data through partner sysfs attributes.

3138) Improper handling of exceptional conditions (CVE-ID: CVE-2026-98761)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to system to leave a disconnected USB Type-C port supplying VBUS power.

The vulnerability exists due to improper handling of a failed fast role swap operation in the Linux kernel TCPM event handler when processing a fast role swap signal during cable disconnection. An attacker with physical access to system can cause a cable to signal a fast role swap to a capable port during disconnection to leave VBUS power sourcing enabled after the operation fails to start.

3139) Use-after-free (CVE-ID: CVE-2026-98762)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through a kernel crash.

The vulnerability exists due to a use-after-free in the Linux kernel DWC2 USB host controller driver when host-owned state is freed before the wakeup timer callback has been synchronized and prevented from rearming. A local user can potentially exploit the race between dwc2_wakeup_detected() and host resource cleanup to access freed memory and cause a denial of service.

3140) Use-after-free (CVE-ID: CVE-2026-98763)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through a kernel use-after-free.

The vulnerability exists due to incomplete clearing of endpoint pointers in usb_disable_endpoint() when disabling a non-zero USB control endpoint with reset_hardware set. A local user can trigger this endpoint lifecycle to leave the opposite direction's endpoint array entry pointing to disabled or freed memory, potentially causing a kernel crash if the stale pointer is subsequently used.

3141) NULL pointer dereference (CVE-ID: CVE-2026-98764)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel panic.

The vulnerability exists due to a null pointer dereference in the FunctionFS ffs_epfile_ioctl() function when processing a FUNCTIONFS_ENDPOINT_DESC ioctl for a gadget operating at a speed for which no endpoint descriptor was supplied. A local user can configure FunctionFS with only full-speed descriptors and issue the ioctl while the gadget operates at a higher speed to trigger a kernel panic and cause a denial of service.

3142) Race condition (CVE-ID: CVE-2026-98765)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through a race between USB gadget request completion and driver teardown.

The vulnerability exists due to incomplete synchronization of request completion callbacks in the Linux kernel dummy-hcd driver when waiting for outstanding callbacks during gadget driver teardown. A local privileged user can trigger overlapping request completion and teardown operations, potentially allowing a gadget driver's module to be unloaded while a completion handler is still running and causing a kernel crash.

3143) Use-after-free (CVE-ID: CVE-2026-98766)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering access to freed kernel memory.

The vulnerability exists due to a use-after-free in the Linux kernel's aspeed-vhub USB gadget driver when queued wakeup work executes after device removal has freed the virtual hub and its ports. A local user can exploit overlapping gadget wakeup activity and device removal to potentially crash the system, as an in-flight wakeup request can also re-arm the work during removal.

3144) Improper handling of exceptional conditions (CVE-ID: CVE-2026-98767)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering an interrupt storm and kernel panic.

The vulnerability exists due to improper handling of an invalid event count in the Linux kernel DWC3 USB gadget driver's dwc3_check_event_buf() function when the GEVNTCOUNT register value exceeds the event buffer length. A local privileged user can write an oversized count directly to GEVNTCOUNT to leave the level-triggered interrupt source asserted, causing repeated unhandled interrupts that trigger a kernel panic.

3145) Race condition (CVE-ID: CVE-2026-98768)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service.

The vulnerability exists due to a race condition in the Linux kernel ANX7411 USB Type-C driver when interrupt handling overlaps with device removal and workqueue destruction. A local user can potentially trigger interrupt-driven work submission during teardown to cause a kernel crash through access to a workqueue being destroyed.

3146) Out-of-bounds write (CVE-ID: CVE-2026-98769)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to system to read or corrupt kernel heap memory, potentially disclosing sensitive information or causing a denial of service.

The vulnerability exists due to out-of-bounds reads and writes in the Linux kernel USB gadget f_uac1_legacy generic_set_cmd() and generic_get_cmd() functions when handling class-specific USB audio control requests. An attacker with physical access to system can use a malicious USB host to send crafted SET_CUR or GET_CUR requests whose bRequest low nibble selects an index from 5 through 15 into the five-element con->data array, accessing up to 44 bytes beyond the array to read or corrupt adjacent heap memory.

3147) Out-of-bounds write (CVE-ID: CVE-2026-98770)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to corrupt kernel memory and potentially cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the USB MIDI gadget driver's jack descriptor arrays in struct f_midi2_usb_config when configuring a large number of jacks via configfs. A local privileged user can configure enough input and output jacks to exceed the array capacities and corrupt adjacent kernel memory, potentially causing a denial of service.

3148) Use of uninitialized resource (CVE-ID: CVE-2026-98771)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to system to disclose stale kernel heap memory to unprivileged userspace.

The vulnerability exists due to use of uninitialized memory in the Linux kernel sierra_ms USB storage driver when accepting short responses to GetSwocInfo requests. An attacker with physical access to system can connect a malicious USB device with vendor ID 0x1199 and product ID 0x0fff that returns a short response to expose up to 5 bytes of stale kernel heap memory per read of the world-readable truinst sysfs attribute on kernels built without init_on_alloc.

3149) Use-after-free (CVE-ID: CVE-2026-98772)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through a kernel crash.

The vulnerability exists due to a use-after-free in the Linux kernel USB serial subsystem when shared USB request completion handlers race with port teardown. A local user can potentially trigger this race during device disconnection, causing a completion handler to access freed port driver data and crash the kernel.

3150) Use-after-free (CVE-ID: CVE-2026-98773)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by potentially crashing the kernel.

The vulnerability exists due to a use-after-free in the Linux kernel USB CDC ACM driver when port shutdown overlaps with device disconnection. A local user can trigger concurrent port shutdown and device disconnection to cause resubmitted USB request blocks to access freed DMA buffers in acm_ctrl_irq() or acm_read_bulk_callback(), potentially crashing the kernel.

The described USB request resubmission occurs when the ALWAYS_POLL_CTRL quirk is set.

3151) Use-after-free (CVE-ID: CVE-2026-98775)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through a kernel use-after-free.

The vulnerability exists due to use-after-free in the Linux kernel Nitro Enclaves driver when ne_create_vm_ioctl() handles a SLOT_ALLOC failure after anon_inode_getfile() succeeds. A local user can trigger this error path to cause deferred file cleanup to invoke ne_enclave_release() after ne_enclave has been freed, leading to an invalid read of slot_uid that may crash the kernel.

3152) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98777)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through exhaustion of system-wide file resources.

The vulnerability exists due to missing resource release in the Linux kernel Binder transaction cleanup when a TF_UPDATE_TXN transaction supersedes a pending asynchronous transaction in a frozen process. A local user can repeatedly trigger transaction replacement to leak binder_txn_fd_fixup entries and their file references, eventually exhausting the system-wide file limit.

The leaked resources survive process exit.

3153) Improper resource shutdown or release (CVE-ID: CVE-2026-98778)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to close unrelated file descriptors in a target process, potentially causing a denial of service.

The vulnerability exists due to improper resource release in the Linux kernel Binder driver when cleaning up a pending asynchronous transaction superseded by a TF_UPDATE_TXN transaction. A local user can trigger transaction replacement to cause the BINDER_TYPE_FDA cleanup handler to interpret stale buffer contents as installed file descriptor numbers and close unrelated file descriptors in the target process.

3154) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98779)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a device resource leak that may lead to a denial of service.

The vulnerability exists due to missing release of registered child platform devices in the AMDGPU driver's acp_hw_init() function when power-domain attachment fails or ACP reset or clock enable operations time out after successful MFD device registration. A local user can potentially trigger an affected initialization failure to leave child devices registered and consume system resources, which may impair system availability.

3155) Memory leak (CVE-ID: CVE-2026-98780)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to consume kernel memory and potentially cause a denial of service.

The vulnerability exists due to a memory leak in amdgpu_discovery_sysfs_ips() when kobject_add() fails during IP instance registration. A local user can potentially trigger this failure path to leave ip_hw_instance allocations unreleased because the initial kobject reference is not dropped and normal sysfs teardown cannot find the failed object. Repeated failures may exhaust kernel memory and cause a denial of service.

3156) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98781)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a device-reference leak that may lead to resource exhaustion.

The vulnerability exists due to a missing release of a device reference in the Linux kernel MediaTek DRM driver's mtk_drm_bind() function when binding a device that is not the mmsys master. A local privileged user can trigger the affected binding path to leave a reference acquired through of_find_device_by_node() unreleased, potentially exhausting resources through repeated triggering.

3157) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98782)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to leak kernel resources, potentially causing a denial of service through resource exhaustion.

The vulnerability exists due to missing release of a registered OVL adaptor platform device in the MediaTek DRM driver when initialization fails after device registration or the driver is unbound. A local privileged user can trigger these driver lifecycle operations, where permitted, to leave platform devices registered and potentially exhaust system resources.

The affected device is created only when the display pipeline requires the OVL adaptor.

3158) Unchecked Return Value (CVE-ID: CVE-2026-98783)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through a kernel crash.

The vulnerability exists due to an unchecked error return in the MediaTek DRM driver's mtk_drm_probe() function when registering the ovl_adaptor platform device. A local user can potentially trigger a kernel crash if able to induce a platform_device_register_data() failure, because the returned error pointer is used without validation and an invalid pointer is passed to subsequent component operations.

3159) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98784)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially exhaust system resources and cause a denial of service.

The vulnerability exists due to missing release of firmware resources in the Linux kernel AMDGPU GFX6 component when tearing down the GFX block. A local privileged user can potentially trigger resource exhaustion through repeated teardown operations because the PFP, ME, CE and RLC firmware resources requested by gfx_v6_0_init_microcode() remain allocated.

3160) NULL pointer dereference (CVE-ID: CVE-2026-98785)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering a kernel crash during GPU reset recovery.

The vulnerability exists due to a NULL pointer dereference in the Linux kernel AMD display driver when resuming after a failed display-state allocation during suspend. A local user can potentially trigger GPU reset recovery under allocation-failure conditions to cause dm_resume() to dereference a NULL cached_dc_state and crash the kernel.

3161) Race condition (CVE-ID: CVE-2026-98790)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning through a race condition in performance-event handling.

The vulnerability exists due to improper synchronization between perf_event_exit_task() and perf_pending_task() in the Linux kernel performance-event subsystem when executing a new program through begin_new_exec(). A local user can trigger concurrent execution and performance-event processing to cause perf_sigtrap() to continue after the event context's task has been set to TASK_TOMBSTONE, triggering WARN_ON_ONCE(event->ctx->task != current).

3162) NULL pointer dereference (CVE-ID: CVE-2026-98791)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel NULL pointer dereference.

The vulnerability exists due to a NULL pointer dereference in mlx5e_xsk_fill_timestamp() when completing outstanding transmit descriptors without a completion queue entry during AF_XDP TX queue teardown. A local user can trigger teardown with an outstanding descriptor that requested a transmit timestamp to cause a denial of service.

3163) Race condition (CVE-ID: CVE-2026-98792)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service.

The vulnerability exists due to a race condition in the Linux kernel netfilter flowtable subsystem when flow garbage collection overlaps with pending hardware offload work. A local user can trigger overlapping flow statistics retrieval and flow removal operations to potentially disrupt kernel operation and cause a denial of service.

3164) Improper input validation (CVE-ID: CVE-2026-98793)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering a kernel crash.

The vulnerability exists due to improper input validation in the Linux kernel netfilter function bpf_ct_set_nat_info() when handling NAT manipulation types. A local privileged user can supply an invalid NAT manipulation type through this function to trigger a kernel warning and potentially cause a kernel crash. If execution continues after the warning, inconsistent connection tracking state causes cleanup to attempt to unlink an uninitialized list node.

3165) Improper input validation (CVE-ID: CVE-2026-98794)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to disrupt IPVS connection handling, potentially causing a denial of service.

The vulnerability exists due to improper validation of connection flags in the Linux kernel IPVS backup server when processing synchronization messages. A remote attacker on the local network can send crafted messages containing the NO_CPORT+TEMPLATE flag combination to make normal connection lookups match templates, or use the ONE_PACKET flag in protocol version 0 messages to create connections that are not hashed and are immediately dropped, potentially disrupting service.

3166) NULL pointer dereference (CVE-ID: CVE-2026-98796)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering network interface startup failure or a kernel NULL pointer dereference.

The vulnerability exists due to an initialization race in the Linux kernel MediaTek Ethernet driver when a network interface is opened after registration but before the internal dummy network device and shared NAPI structures are initialized. A local privileged user can trigger an interface open during this window to cause a denial of service by accessing the missing dummy device or an uninitialized NAPI device pointer.

3167) Out-of-bounds read (CVE-ID: CVE-2026-98797)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering an out-of-bounds kernel memory access that may crash the system.

The vulnerability exists due to an out-of-bounds read in the Linux kernel's transmit queue handling and taprio_enqueue() when nested packet transmissions leak the skip_txqueue flag into an outer transmission, causing a stale queue mapping to index beyond taprio's child array. A local user can configure skbedit and mirred actions with CAP_NET_ADMIN in a network namespace and redirect traffic between devices with different queue counts to trigger an invalid queue pointer dereference and potentially cause a denial of service.

3168) NULL pointer dereference (CVE-ID: CVE-2026-98798)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by leaving networking unresponsive until a reboot.

The vulnerability exists due to a null pointer dereference in the Linux kernel bcmgenet driver's receive coalescing handling when setting receive coalescing parameters on an interface that has never been opened. A local privileged user can run a command such as "ethtool -C eth0 rx-usecs 50" to dereference an uninitialized receive ring private pointer and trigger a kernel fault while the RTNL lock is held, leaving networking stuck.

3169) Integer overflow (CVE-ID: CVE-2026-98801)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt socket memory reservation accounting and potentially cause a denial of service.

The vulnerability exists due to integer overflow in the Linux kernel's sk_setsockopt() handling of SO_RESERVE_MEM when processing reservation values near INT_MAX. A local user can supply an excessively large reservation value to overflow signed 32-bit arithmetic in sk_mem_pages(delta) and (pages << PAGE_SHIFT), corrupting sk_forward_alloc and sk_reserved_mem and potentially disrupting memory management and system availability.

3170) Race condition (CVE-ID: CVE-2026-98801)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt socket memory accounting and potentially cause a denial of service.

The vulnerability exists due to improper synchronization in the Linux kernel's UDP socket memory reservation handling when processing SO_RESERVE_MEM operations concurrently with packet reception or release. A local user can invoke setsockopt(SO_RESERVE_MEM) on a UDP socket during these operations to corrupt sk_forward_alloc and memory control group accounting, potentially disrupting memory management and system availability.

3171) Reusing a Nonce, Key Pair in Encryption (CVE-ID: CVE-2026-98805)

CWE-ID: CWE-323 - Reusing a Nonce, Key Pair in Encryption

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the confidentiality of encrypted TIPC traffic and forge authenticated packets.

The vulnerability exists due to reuse of AES-GCM nonces in the Linux kernel TIPC encryption implementation when a peer reports a receive-key change and the per-peer counter resets while the sender retains the same transmit key and salt. A remote attacker can analyze captured packets with reused nonces to compromise traffic confidentiality, recover the GCM authentication key, and generate valid authentication tags for modified ciphertexts.

3172) Out-of-bounds read (CVE-ID: CVE-2026-98807)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through a kernel crash.

The vulnerability exists due to an out-of-bounds read in the mlx5_handle_changeupper_event() and mlx5_handle_changeinfodata_event() functions when processing team device events. A local privileged user can trigger team device events that cause bonding-specific APIs to interpret smaller team_port structures as bond slave structures, potentially causing a kernel crash.

3173) Out-of-bounds write (CVE-ID: CVE-2026-98808)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory and potentially cause a denial of service.

The vulnerability exists due to an out-of-bounds write in bcm_sysport_get_stats() when collecting network interface statistics through ethtool. A local user can trigger statistics collection to potentially corrupt kernel memory because the function uses the full statistics index rather than the compacted destination index when writing to the allocated buffer.

The issue occurs on SYSTEMPORT Lite, where unsupported statistics are skipped during collection.

3174) Resource exhaustion (CVE-ID: CVE-2026-98809)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by blocking Bluetooth controller unregistration for an extended period.

The vulnerability exists due to uncontrolled resource consumption in the Linux kernel Bluetooth HCI synchronous command worker when draining an unbounded command backlog during controller unregistration after command processing has been disabled. A local privileged user can queue MGMT commands against an unresponsive controller and close /dev/vhci to cause controller unregistration to wait for a separate timeout for each queued command.

Each queued HCI command incurs a two-second timeout; a locally reproduced backlog of more than 5,000 entries resulted in hours of blocking.

3175) Race condition (CVE-ID: CVE-2026-98811)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to retain kernel resources unnecessarily, potentially causing a denial of service through resource exhaustion.

The vulnerability exists due to a race condition in the Linux kernel traffic-control classifier error handling in net/sched/cls_api.c when concurrent filter-add requests on the same chain and priority both fail. A local user can trigger these concurrent failures to leave an empty classifier proto linked to the chain, retaining chain, block, and classifier module references and potentially exhausting resources.

Exploitation requires CAP_NET_ADMIN, but namespace-local capability obtained through unshare -Urn is sufficient.

3176) NULL pointer dereference (CVE-ID: CVE-2026-98812)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel NULL pointer dereference.

The vulnerability exists due to premature publication of an incompletely initialized object in the Linux kernel MCTP subsystem's mctp_add_dev() function when concurrent readers access a device during initialization. A local user can trigger MCTP message processing during this window to dereference the still-NULL mdev->dev pointer and cause a kernel crash.

3177) Integer overflow (CVE-ID: CVE-2026-98819)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger out-of-bounds reads and potentially cause a denial of service.

The vulnerability exists due to integer wraparound and insufficient record-length validation in the Linux kernel Bluetooth btintel DDC configuration parser when processing firmware records. A local privileged user can supply malformed DDC configuration data, if able to influence the firmware input, to cause record lengths to wrap or exceed the remaining firmware bytes, potentially triggering out-of-bounds reads and a denial of service.

3178) Improper access control (CVE-ID: CVE-2026-98822)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass VLAN isolation and potentially disclose network traffic to a station on a different VLAN within the same basic service set (BSS).

The vulnerability exists due to improper access control in the Linux kernel mac80211 function ieee80211_lookup_ra_sta() when resolving destination stations for AP and AP VLAN unicast frames. A local user can submit a unicast frame on one interface addressed to a station on another VLAN in the same BSS to cause unauthorized cross-VLAN delivery, because the station lookup searches across the BSS rather than restricting matches to the transmitting interface.

3179) Double free (CVE-ID: CVE-2026-98823)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to potentially cause a denial of service through kernel memory corruption.

The vulnerability exists due to a double free in the Linux kernel cfg80211 scan-entry handling when merging a hidden-group probe-response entry into an associated entry after a channel switch. A remote attacker on the local network can trigger the affected processing to give two entries ownership of the same beacon information-element allocation, causing it to be freed twice when the entries are released and potentially resulting in a kernel crash.

3180) Unchecked Return Value (CVE-ID: CVE-2026-98825)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service by triggering a kernel crash.

The vulnerability exists due to an unchecked error return in the Linux kernel's mpfs_rtc_probe() function when acquiring the RTC reference clock. A local privileged user can potentially trigger driver probing under conditions where devm_clk_get() returns an error pointer, causing clk_get_rate() to dereference that pointer and crash the kernel.

3181) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98826)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially prevent successful initialization of the AC100 RTC device.

The vulnerability exists due to missing release of the RTC-32k clock in the Linux kernel AC100 RTC driver when probing fails after clock registration, including when the ADDA 4M parent clock cannot be found. A local user can potentially trigger an affected failure path to leave the clock registered, causing a later probe of the same device to fail because its clock name is already present in the global clock list.

3182) Use-after-free (CVE-ID: CVE-2026-98826)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through access to freed kernel memory.

The vulnerability exists due to use-after-free in the Linux kernel AC100 RTC clock provider when RTC device registration fails after the clock provider has been registered. A local user can potentially trigger a subsequent clock lookup that accesses freed chip->clk_data through of_clk_hw_onecell_get() to cause a kernel fault and denial of service.

The triggering RTC device registration failure occurs only when devm_rtc_register_device() returns -ENOMEM.

3183) Out-of-bounds write (CVE-ID: CVE-2026-98827)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory and potentially cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the ath9k_htc driver's __hif_usb_tx() function when aggregating outgoing frames without checking their cumulative byte length against the transmit buffer capacity. A local user can trigger aggregation of large outgoing frames to exceed the 32768-byte buffer and corrupt kernel memory, potentially causing a denial of service.

3184) Out-of-bounds read (CVE-ID: CVE-2026-98828)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds read that may disclose sensitive information or cause a denial of service.

The vulnerability exists due to an out-of-bounds read in ath9k_wmi_rsp_callback() when processing a WMI command response shorter than the expected response length. A local user can supply a truncated response, if able to control device responses, to cause the kernel to copy bytes beyond the socket buffer payload into the waiting command's response buffer.

3185) Out-of-bounds write (CVE-ID: CVE-2026-98830)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause memory corruption and potentially a denial of service in the Linux kernel.

The vulnerability exists due to an out-of-bounds write and an out-of-bounds read in wfx_hif_read_mib() in the wfx wireless driver when processing firmware responses to MIB read requests. A local privileged user can supply a firmware response with a length field exceeding the caller-provided val_len to overwrite the caller's buffer and read beyond the reply allocation, potentially causing a kernel crash.

3186) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98831)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak kernel resources, potentially causing a denial of service through resource exhaustion.

The vulnerability exists due to missing release of fragment references in the Linux kernel device tree overlay component when overlay changeset initialization fails after some fragments have been initialized. A local user can potentially trigger repeated initialization failures to accumulate unreleased target and overlay references and exhaust kernel resources.

3187) Function Call with Incorrectly Specified Arguments (CVE-ID: CVE-2026-98833)

CWE-ID: CWE-628 - Function Call with Incorrectly Specified Arguments

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering invalid memory access in the kernel.

The vulnerability exists due to an incorrect callback argument in __get_mtd_device() in the Linux kernel MTD core when acquiring a gluebi partition device. A local user can trigger device acquisition for a gluebi partition to potentially crash the kernel because gluebi_get_device() uses container_of() on a partition MTD object instead of the required master MTD object.

3188) Off-by-one (CVE-ID: CVE-2026-98835)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read that may disclose kernel memory or cause a denial of service.

The vulnerability exists due to an off-by-one array bounds check in the Linux kernel Kionix KX022A accelerometer driver's kx022a_read_raw() function when converting a register value into a sampling-frequency table index. A local user can trigger an out-of-bounds read if the masked register value equals the number of table entries, potentially disclosing kernel memory or causing a denial of service.

3189) Out-of-bounds write (CVE-ID: CVE-2026-98836)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to system to corrupt kernel memory, potentially causing a denial of service.

The vulnerability exists due to an out-of-bounds write in the Linux kernel ALSA Line6 driver's submit_audio_out_urb() function when preparing playback packets whose calculated sizes exceed the allocated output buffer capacity. An attacker with physical access to system can connect a specially crafted USB device declaring a large input endpoint packet size and a small output endpoint packet size to cause playback data copies or idle-stream memory initialization to write beyond the allocated buffer and corrupt kernel memory.

3190) Use-after-free (CVE-ID: CVE-2026-98837)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering access to freed kernel memory.

The vulnerability exists due to use-after-free in the Linux kernel ALSA caiaq driver when device probing fails after an input device has been registered. A local user can read the input device's "uevent" attribute after this failure to trigger a dereference of freed device state, potentially causing a kernel crash.

3191) Out-of-bounds read (CVE-ID: CVE-2026-98838)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger an out-of-bounds kernel memory read, potentially causing a denial of service.

The vulnerability exists due to an out-of-bounds read in the Linux kernel virtual terminal and framebuffer console rendering path when processing a DEC alignment test on a background console with a changed font size. A local privileged user can configure different font sizes on visible and background consoles, enable framebuffer rotation, and write the ESC # 8 sequence to the background console to trigger rendering against a backing buffer that was not resized, potentially causing a kernel crash.

3192) Use-after-free (CVE-ID: CVE-2026-98840)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through a kernel use-after-free.

The vulnerability exists due to use-after-free in the Linux kernel's vcs_write() function when a copy failure exits the write loop without refreshing a virtual console pointer following concurrent console deallocation. A local user can perform virtual console writes that encounter a copy failure while racing with console deallocation to trigger a stale-pointer dereference in vcs_notifier() and potentially crash the kernel.

3193) Sensitive Information in Resource Not Removed Before Reuse (CVE-ID: CVE-2026-98844)

CWE-ID: CWE-226 - Sensitive Information in Resource Not Removed Before Reuse

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to expose stale memory-mapped data as file contents when extending a file.

The vulnerability exists due to incomplete clearing of stale pagecache data in the Linux kernel netfs buffered and unbuffered/direct write paths when extending a file beyond its previous end. A local user can leave data beyond the end of a file through a memory mapping and subsequently write at a later offset to expose that stale data in the newly created hole instead of zero-filled contents.

3194) Use-after-free (CVE-ID: CVE-2026-98846)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a kernel use-after-free.

The vulnerability exists due to a use-after-free in the Linux kernel SCTP function sctp_sendmsg_to_asoc() when a connection wait overlaps with a read-side socket shutdown and processing of an out-of-the-blue ABORT. A local user can trigger concurrent SCTP socket operations under these conditions to leave the send path using a freed association, potentially causing a kernel crash.

3195) Race condition (CVE-ID: CVE-2026-98847)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through a kernel crash.

The vulnerability exists due to a race condition in the Linux kernel SPEAr RTC driver when enabling the alarm interrupt before initializing the MMIO address and spinlock. A local user can potentially exploit an interrupt occurring during device initialization to cause the interrupt handler to access uninitialized state and crash the kernel.

3196) Improper initialization (CVE-ID: CVE-2026-98848)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service on systems configured to trap bounds-sanitizer violations.

The vulnerability exists due to improper initialization of the array element count in ac100_rtc_register_clks() in the Linux kernel AC100 RTC driver when probing the device with CONFIG_UBSAN_BOUNDS, CONFIG_UBSAN_TRAP, and a compiler supporting __counted_by. A local privileged user can trigger the affected probe path, if permitted, to cause a bounds-sanitizer trap because clock pointers are stored in .hws[] before its associated .num count is initialized.

3197) Integer overflow (CVE-ID: CVE-2026-98850)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel BUG.

The vulnerability exists due to integer overflow in the Linux kernel's tpacket_snd() function when accumulating transmitted packet lengths during a blocking TX_RING send call. A local user can use CAP_NET_RAW to submit packets while concurrently recycling completed frames, causing the signed byte count to wrap to -EIOCBQUEUED and trigger a BUG in sock_sendmsg_nosec().

On systems configured to panic on oops, exploitation can panic the host kernel.

3198) Improper update of reference count (CVE-ID: CVE-2026-98851)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by preventing the removal of netfilter flowtables.

The vulnerability exists due to improper reference count management in nft_flow_offload_init() when nf_ct_netns_get() fails during flow offload rule initialization. A local privileged user can attempt rule additions that encounter this failure to leak flowtable references and prevent the affected flowtables from being removed.

3199) Improper input validation (CVE-ID: CVE-2026-98852)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disrupt network communication by triggering the dropping of tunneled IPv6 packets.

The vulnerability exists due to improper validation of IPv6 extension headers in the Linux kernel's segmentation and checksum offload handling in net/core/dev.c when processing tunneled packets. A local user can generate affected tunneled traffic that reaches an incompatible software checksum fallback path, triggering kernel warnings and packet drops that disrupt network communication.

3200) NULL pointer dereference (CVE-ID: CVE-2026-98854)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering a kernel NULL pointer dereference.

The vulnerability exists due to improper handling of a negative changeset identifier in free_overlay_changeset() when cleaning up after an ID allocation failure during device tree overlay application. A local privileged user can trigger this error path, if able to initiate overlay application under these failure conditions, to cause a kernel crash and denial of service.

3201) Double free (CVE-ID: CVE-2026-98855)

CWE-ID: CWE-415 - Double Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through kernel memory corruption.

The vulnerability exists due to a double free in add_changeset_property() in the Linux kernel device tree overlay subsystem when adding a property to a not-yet-live target node fails. A local privileged user can trigger this failure during overlay processing to potentially cause a kernel crash: the error path frees the property while leaving its pointer in the node's deadprops list, and of_node_release() frees it again when the aborted overlay's node is released.

3202) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-98856)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disrupt kernel execution and potentially cause a denial of service.

The vulnerability exists due to premature termination of overlap checks in get_optimized_kprobe() in kernel/kprobes.c when arming overlapping probes on x86. A local privileged user can arrange overlapping probes with an intervening disabled probe so that a new probe's INT3 instruction overwrites part of an active optimized probe's jump displacement, redirecting kernel execution to an incorrect address and potentially causing a denial of service.

3203) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-98857)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to exhaust kernel memory and potentially cause a denial of service.

The vulnerability exists due to unrestricted cache entry allocation in the Linux kernel IPVS LBLC and LBLCR schedulers when handling traffic to previously unseen destination addresses. A remote attacker can generate traffic to many distinct destination addresses and continue using the resulting cache entries to prevent their reclamation, allowing cache growth to exhaust kernel memory and potentially cause a denial of service.

3204) Use-after-free (CVE-ID: CVE-2026-98859)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by potentially crashing the kernel.

The vulnerability exists due to a use-after-free in the Linux kernel HID multitouch driver when a report rearms the sticky-finger release timer during driver removal. A local user can potentially trigger a report at this point to leave the timer queued after its associated device data is freed, causing mt_expired_timeout() to access freed memory and potentially crash the kernel.

3205) Use-after-free (CVE-ID: CVE-2026-98862)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through a kernel use-after-free.

The vulnerability exists due to use-after-free in the Linux kernel audit subsystem's kill_rules() function when pruning an audit tree containing mixed AUDIT_DIR and AUDIT_EXE rules. A local privileged user can install a rule using AUDIT_ADD_RULE with CAP_AUDIT_CONTROL and remove the watched directory while another task evaluates the rule, causing audit_mark_compare() to access an executable mark already freed by fsnotify and potentially trigger a kernel crash.

3206) Reachable assertion (CVE-ID: CVE-2026-98872)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by crashing the Linux kernel.

The vulnerability exists due to a reachable assertion in the freevxfs vxfs_bmap_typed() function when processing an on-disk typed extent with an unsupported type value. A local privileged user can trigger processing of such an extent through ioctl(FIBMAP) on a regular file to invoke BUG() and crash the kernel.

3207) Missing initialization of resource (CVE-ID: CVE-2026-98873)

CWE-ID: CWE-909 - Missing initialization of resource

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially disclose sensitive information from uninitialized kernel memory.

The vulnerability exists due to missing initialization of connection-tracking expectation objects in the Linux kernel netfilter subsystem when expectation data is returned to userspace through ctnetlink. A local privileged user can obtain expectation data through ctnetlink to potentially read uninitialized kernel memory exposed in the returned data.

3208) NULL pointer dereference (CVE-ID: CVE-2026-98875)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering a crash during GPU initialization.

The vulnerability exists due to a null pointer dereference in the Linux kernel Nouveau driver's GA100 initialization when booting GSP-RM. A local user can potentially trigger the affected initialization path to cause a denial of service because the booter constructor in tu102_gsp_oneinit() accesses device->sec2 even though the missing SEC2 chip-table entry leaves that pointer null.

3209) NULL pointer dereference (CVE-ID: CVE-2026-98876)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering a kernel NULL pointer dereference.

The vulnerability exists due to a missing NULL pointer check in host1x_device_init() in the Linux kernel host1x bus component when handling initialization error teardown for a client whose operations pointer is NULL. A local user can trigger the affected teardown paths to cause a NULL pointer dereference that may crash the kernel.

3210) NULL pointer dereference (CVE-ID: CVE-2026-98877)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel panic.

The vulnerability exists due to a null pointer dereference in the Linux kernel GICv4 interrupt controller support when kvm-arm.vgic_v4_enable=1 is set on a GICv4 system without an MSI controller device tree node or an available ITS. A local user can trigger an access to the null gic_domain pointer to cause a kernel panic and denial of service.

3211) Unchecked Return Value (CVE-ID: CVE-2026-98879)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering a kernel assertion failure.

The vulnerability exists due to an unchecked return value from sb_set_blocksize() in isofs_fill_super() when mounting an ISO filesystem with a block size greater than PAGE_SIZE. A local privileged user can cause such a filesystem to be mounted to trigger the BUG_ON(offset >= folio_size(folio)) assertion in folio_set_bh() during the first __bread_gfp() call, causing a denial of service.

3212) Unchecked Return Value (CVE-ID: CVE-2026-98880)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to unchecked return values from sb_set_blocksize in the ntfs3 ntfs_init_from_boot function when mounting an NTFS filesystem. A local privileged user can trigger mounting with a block size greater than PAGE_SIZE to cause a kernel assertion failure in folio_set_bh during the first __bread_gfp call, resulting in a denial of service.

3213) Resource exhaustion (CVE-ID: CVE-2026-98881)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by prolonging the blocking of network configuration operations.

The vulnerability exists due to excessive synchronization waits in the Linux kernel br_multicast_dev_del() function when tearing down bridge devices. A local user can trigger bridge device teardown to cause excessive RTNL lock contention through a stale rcu_barrier() call, delaying other network operations.

3214) Out-of-bounds write (CVE-ID: CVE-2026-98882)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially corrupt kernel memory and cause a denial of service.

The vulnerability exists due to insufficient range checking of frame-buffer indices in the Wave5 driver's wave5_vpu_dec_get_output_info() function when processing invalid decoder output information. A local user can potentially trigger an out-of-range frame-buffer access through invalid decoder output information to corrupt kernel memory and cause a denial of service.

3215) Numeric Truncation Error (CVE-ID: CVE-2026-98884)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel crash.

The vulnerability exists due to integer truncation in the Linux kernel MMC core when an excessively large host-provided max_segs value is truncated to zero. A local user can trigger MMC request initialization with such an invalid host configuration to cause a zero-size scatter-gather allocation and a subsequent invalid memory access in sg_init_table(), crashing the kernel.

3216) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-98885)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger kernel warnings during file integrity appraisal.

The vulnerability exists due to insufficient checks for file write restrictions in the Linux kernel's ima_fix_xattr() function when updating extended attributes during integrity appraisal. A local user can open a file subject to appraisal on a read-only ext4 filesystem to trigger an extended attribute update that attempts to start an invalid filesystem transaction, producing a kernel warning.

3217) Unchecked Return Value (CVE-ID: CVE-2026-98886)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by causing HDMI I2C read operations to wait indefinitely.

The vulnerability exists due to unchecked timeout and interruption return values in the xfer_read() function of the Oaktrail HDMI I2C driver when waiting for a read transaction to complete. A local user can trigger an affected read operation under conditions where the interrupt does not advance the transaction state to cause an indefinite wait, potentially blocking subsequent HDMI I2C transfers.

3218) Out-of-bounds read (CVE-ID: CVE-2026-98887)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger an out-of-bounds kernel memory read that may cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the Linux kernel mac80211_hwsim function hwsim_tx_info_frame_received_nl() when processing an undersized HWSIM_ATTR_TX_INFO netlink attribute. A local privileged user can submit a short or zero-length attribute that passes the maximum-length-only validation to trigger an unconditional eight-byte read beyond the attribute payload, potentially causing a kernel fault.

3219) Improper handling of exceptional conditions (CVE-ID: CVE-2026-98888)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of nested probe state in the Linux kernel arm64 kprobes implementation when a probe is hit while another probe is preparing or executing its out-of-line single-step instruction. A local user can trigger this condition through execution paths involving configured probes to cause a denial of service, as recoverable reentry is treated as unrecoverable and nested probes can overwrite the outer probe's saved interrupt state, leaving interrupts permanently disabled.

3220) Out-of-bounds write (CVE-ID: CVE-2026-98889)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory, potentially causing a denial of service.

The vulnerability exists due to an out-of-bounds write in the iwlwifi MVM driver's scheduled scan handling when building probe requests before validating information element lengths. A local user can supply oversized information elements for a scheduled scan to overflow the fixed-size probe request buffer, potentially causing a kernel crash.

3221) Out-of-bounds read (CVE-ID: CVE-2026-98891)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to trigger an out-of-bounds read that may cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the mac80211 ieee80211_rx_mgmt_deauth() function when processing truncated Wi-Fi deauthentication frames. A remote attacker on the local network can transmit a frame missing the reason code field to trigger a read beyond the received frame data before its length is checked, potentially causing a denial of service.

3222) Out-of-bounds read (CVE-ID: CVE-2026-98892)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds read that may cause a denial of service.

The vulnerability exists due to insufficient payload-length validation in the Linux kernel ARM SCMI BASE_ERROR_EVENT notification parser when processing variable-length message reports. A local user can supply a truncated notification payload whose error_status specifies more reports than the payload contains to trigger reads beyond the received data, potentially causing a kernel crash.

3223) Out-of-bounds read (CVE-ID: CVE-2026-98893)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds read that may cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the ARM SCMI sensor notification parser when processing truncated SENSOR_UPDATE notifications. A local user can supply a truncated notification, if able to control notification payloads, to cause the parser to read beyond the received buffer, potentially causing a denial of service.

3224) Use-after-free (CVE-ID: CVE-2026-98896)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service through a potential kernel crash.

The vulnerability exists due to use-after-free in the Linux kernel Thunderbolt hotplug handling code when queued work executes after its associated domain has been removed. A local privileged user can trigger device-router hotplug events concurrently with driver unloading to cause the hotplug handler to access freed domain memory, potentially crashing the kernel.

3225) Use of uninitialized resource (CVE-ID: CVE-2026-98898)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service.

The vulnerability exists due to use of an uninitialized resource in the Linux kernel AMD GPU power management component when processing interrupts that schedule thermal work. A local user can potentially trigger work scheduling on an uninitialized thermal work queue to cause a kernel crash and denial of service.

The vulnerable condition occurs when dynamic power management is disabled with the amdgpu.dpm=0 module parameter.

3226) Improper locking (CVE-ID: CVE-2026-98899)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service.

The vulnerability exists due to improper locking in the Linux kernel netfilter ipset hash-table implementation when garbage collection accesses a shared hash table without the required read-copy-update protection. A local user can potentially trigger concurrent hash-table operations to cause unsafe table access and a denial of service.

3227) Integer overflow (CVE-ID: CVE-2026-98900)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through excessive kernel memory allocation and bypass grant-count limits.

The vulnerability exists due to insufficient grant-count validation and integer overflow in the Xen grant allocation function gntalloc_ioctl_alloc() when processing user-controlled grant allocation requests. A local user can supply excessive grant counts to trigger memory allocation before limit enforcement or cause arithmetic wraparound in grant accounting, potentially exhausting kernel memory or bypassing grant-count limits.

3228) Improper Enforcement of Behavioral Workflow (CVE-ID: CVE-2026-98901)

CWE-ID: CWE-841 - Improper Enforcement of Behavioral Workflow

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to compromise file cache consistency, potentially causing stale reads or file data corruption.

The vulnerability exists due to improper enforcement of lease state transitions in the Linux kernel ksmbd server when processing writes, truncates, and SMB2 lease break acknowledgments. A remote user can trigger incorrectly handled lease breaks and acknowledgments to leave caching states inconsistent with file operations, potentially causing stale reads or file data corruption.

3229) Integer overflow (CVE-ID: CVE-2026-98902)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to interfere with RAID5 stripe batching, potentially compromising storage consistency.

The vulnerability exists due to integer wraparound and an incorrect sequence-number comparison in the Linux kernel RAID5 stripe batching logic when a 32-bit sequence counter wraps. A local user can potentially exercise stripe batching across this wraparound condition to cause newer bm_seq values to be treated as older values, potentially compromising storage consistency.

3230) Race condition (CVE-ID: CVE-2026-98903)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by disrupting shared interrupt handling.

The vulnerability exists due to a race condition in the Linux kernel i.MX mailbox driver when receive interrupt processing overlaps with channel shutdown. A local user can attempt to trigger this overlap to leave receive events enabled after the channel's interrupt handler is removed, potentially causing the interrupt core to disable the shared interrupt when the removed channel subsequently generates an interrupt.

3231) Incorrect behavior order (CVE-ID: CVE-2026-98904)

CWE-ID: CWE-696 - Incorrect Behavior Order

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially disrupt device operation and cause a denial of service.

The vulnerability exists due to incorrect initialization and cleanup ordering in the Linux kernel i.MX mailbox driver when the device is used before probe completion or runtime power management is disabled before mailbox shutdown. A local user can potentially exercise the device during these lifecycle transitions to disrupt device operation and cause a denial of service.

3232) Improper handling of exceptional conditions (CVE-ID: CVE-2026-98906)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause kernel memory corruption and a denial of service.

The vulnerability exists due to incomplete restoration of receive state in the lan966x driver's lan966x_fdma_reload() function when receive-resource allocation fails during an MTU change. A local privileged user can trigger an MTU reload that encounters an allocation failure to leave receive processing using inconsistent page geometry and stale XDP receive-queue memory-model registrations, potentially causing kernel memory corruption and a denial of service.

3233) Race condition (CVE-ID: CVE-2026-98907)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service by disrupting Btrfs superblock reads.

The vulnerability exists due to a race condition in the Btrfs sb_write_pointer() function when reading a superblock from the block device page cache concurrently with block size changes. A local privileged user can attempt to overlap block size changes through BLKBSZSET with reads through read_cache_page_gfp() to potentially cause inconsistent reads and disrupt filesystem operations.

3234) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98908)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to exhaust packet-filtering resources and potentially cause a denial of service.

The vulnerability exists due to missing release of allocated resources in the Linux kernel's Microchip Sparx5 PSFP setup code when traffic-control flower setup fails after acquiring resources. A local privileged user can trigger repeated failing setup operations to leave stream gates, flow meters, or stream filters allocated and potentially exhaust resources needed for subsequent filtering operations. Reusing an existing flow meter can also leave its reference count incremented because sparx5_psfp_fm_add() does not return the acquired identifier before its early return.

3235) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98909)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through unreleased kernel resources.

The vulnerability exists due to missing resource cleanup in the Linux kernel CPSW Ethernet driver's cpsw_probe() function when port registration fails after successful devlink registration. A local privileged user can potentially exploit this failure path to leave a devlink instance and its parameters registered after underlying resources have been released, which may disrupt system operation.

3236) Incomplete cleanup (CVE-ID: CVE-2026-98910)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disrupt subsequent GPU debug trap enable and disable operations.

The vulnerability exists due to incomplete cleanup in the Linux kernel AMD KFD kfd_dbg_trap_enable() function when copying runtime information to userspace fails. A local user can trigger a copy_to_user() failure during debug trap setup to leave inconsistent trap state and an unbalanced process reference count, potentially disrupting subsequent debug trap enable and disable operations.

3237) Release of invalid pointer or reference (CVE-ID: CVE-2026-98911)

CWE-ID: CWE-763 - Release of invalid pointer or reference

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially cause a denial of service.

The vulnerability exists due to an invalid pointer release in the Linux kernel dpaa2-switch driver's dpaa2_switch_rx() function when handling errors during received-frame processing. A remote attacker can potentially trigger the affected error path through network traffic to cause a kernel crash when a receive frame descriptor is incorrectly treated as a transmit frame descriptor and its software annotation data is used as a socket-buffer pointer for deallocation.

3238) Incorrect comparison (CVE-ID: CVE-2026-98912)

CWE-ID: CWE-697 - Incorrect Comparison

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause data to be written beyond the requested userspace buffer length.

The vulnerability exists due to an inverted buffer-length comparison in snd_seq_oss_read() when processing reads of queued OSS sequencer events. A local user can request a read shorter than the next queued event to cause the event to be copied beyond the requested userspace buffer length.

3239) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98913)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to leak device references, potentially degrading system availability.

The vulnerability exists due to missing release of a PTP PCI device reference in the Linux kernel ThunderX network driver's nicvf_probe() function when initialization fails after cavium_ptp_get() acquires the reference. A local privileged user can trigger affected initialization failure paths to leave device references unreleased, potentially causing resource retention and degrading system availability.

3240) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-98915)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by interacting with a video device during driver removal.

The vulnerability exists due to improper resource lifecycle management in the Linux kernel video-i2c driver when unregistering a video device without first disconnecting its videobuf2 queue. A local user can use a video device across driver removal to potentially disrupt kernel operation through access to a queue that has not been properly disconnected.

3241) Reachable assertion (CVE-ID: CVE-2026-98923)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger a spurious kernel warning.

The vulnerability exists due to a reachable warning assertion in the arm64 ioremap_prot() function when processing valid user mappings whose protection values lack PTE_USER. A local privileged user can map a stack-top page through /dev/mem with PROT_NONE and then read that process's cmdline entry in /proc to trigger WARN_ON_ONCE() through generic_access_phys().

3242) Incorrect calculation (CVE-ID: CVE-2026-98925)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger kernel warnings and potentially disrupt TCP receive processing.

The vulnerability exists due to incorrect sequence-number accounting in the Linux kernel BPF sockmap component when a BPF stream_verdict program redirects data back to the same socket with BPF_F_INGRESS. A local privileged user can trigger this self-redirect followed by a socket read to advance copied_seq twice for the same data, triggering kernel warnings and potentially disrupting TCP receive processing.

3243) Improper locking (CVE-ID: CVE-2026-98930)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service.

The vulnerability exists due to improper locking in the Linux kernel's s390 KVM interrupt handling when processing a SIGP Stop and Store Status operation for an already stopped vCPU. A local user can trigger a status-store operation that writes to userspace while a spinlock is held, allowing a page fault to require blocking in an atomic context and potentially cause a denial of service.

3244) NULL pointer dereference (CVE-ID: CVE-2026-98931)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the Linux kernel SPI-NAND subsystem when probing a device with the "nand-no-ecc-engine" device tree property set. A local privileged user can trigger probing of such a device, if able to do so, to cause a kernel oops because the code checks the ECC engine's integration type without verifying that the engine pointer is non-null.

3245) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-98933)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service on affected AMD platforms.

The vulnerability exists due to excessive retention of a runtime power-management reference in the Linux kernel USB3 root hub handling code when resuming a hub on affected AMD platforms. A local user can repeatedly trigger USB subsystem wakeups to cause system crashes because the reference remains held for 200 milliseconds after each resume.

3246) Function Call with Incorrectly Specified Arguments (CVE-ID: CVE-2026-98934)

CWE-ID: CWE-628 - Function Call with Incorrectly Specified Arguments

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger a kernel warning and potentially disrupt system availability.

The vulnerability exists due to failure to supply a required network namespace pointer in seg6_make_flowlabel() when computing flow hashes for packets without an associated device or socket. A local privileged user can trigger transmission of a TIPC UDP bearer discovery message through the affected path to provoke a warning in __skb_flow_dissect(), potentially disrupting system availability.

The reported trigger requires an IPv4 route using segment routing encapsulation and net.ipv6.seg6_flowlabel set to 1.

3247) Use of Uninitialized Variable (CVE-ID: CVE-2026-98935)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized kernel stack data.

The vulnerability exists due to uninitialized padding in the struct rtc_wkalrm structure in rtc_dev_ioctl() when handling RTC_WKALRM_RD ioctl requests. A local user can issue this ioctl to obtain a structure containing residual kernel stack data in padding bytes after the pending member.

3248) Improper initialization (CVE-ID: CVE-2026-98936)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by preventing new wireless stations or mesh peers from connecting.

The vulnerability exists due to improper reinitialization of the station counter in the Linux kernel ath11k driver's ath11k_mac_op_start() function when restarting wireless hardware. A local user can potentially exploit stale station accounting after repeated hardware restarts to cause new station or mesh peer connections to be rejected because the driver incorrectly considers its station limit reached.

3249) Incorrect authorization (CVE-ID: CVE-2026-98937)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to collect kernel callchains without the required kernel profiling privilege, potentially disclosing kernel execution information.

The vulnerability exists due to incorrect authorization in perf_event_open() in kernel/events/core.c when processing requests for kernel callchain collection. A local user can request PERF_SAMPLE_CALLCHAIN with attr.exclude_kernel == 1 and attr.exclude_callchain_kernel == 0 to bypass the perf_allow_kernel() permission check and capture kernel callchains.

3250) Out-of-bounds write (CVE-ID: CVE-2026-98940)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through kernel memory corruption.

The vulnerability exists due to an out-of-bounds write in the Qualcomm LPASS CPU driver's asoc_qcom_lpass_cpu_platform_probe() function when configuring playback channel constraints for a DAI using LPAIF_I2SCTL_MODE_QUAD01 on platforms with sparse DAI IDs. A local privileged user can trigger the affected probe path to cause a hardware port ID to be used as a DAI driver table index, potentially corrupting kernel memory and causing a denial of service.

3251) Use-after-free (CVE-ID: CVE-2026-98944)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service.

The vulnerability exists due to a use-after-free in the Linux kernel Steam HID driver's registration error handling when registration fails after a wireless device's battery has been registered. A local user can exercise the affected registration failure path to potentially cause a kernel crash if the lingering power_supply object accesses device state after the associated steam object has been freed.

3252) Use-after-free (CVE-ID: CVE-2026-98945)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a kernel crash.

The vulnerability exists due to use-after-free in the Linux kernel Steam HID driver when callbacks are scheduled during device teardown and subsequently access a freed steam structure. A local user can potentially trigger this teardown race to cause a kernel crash by accessing freed memory.

3253) Memory leak (CVE-ID: CVE-2026-98947)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to exhaust kernel memory and potentially cause a denial of service.

The vulnerability exists due to a memory leak in the Linux kernel VMCI vsock datagram transport when receiving datagrams during socket closure. A local user can trigger datagram reception concurrently with socket closure to cause packet buffers to be moved from the socket backlog into an already-cleared receive queue, leaving them allocated and potentially exhausting kernel memory.

3254) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98948)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to exhaust port range register resources and potentially cause a denial of service.

The vulnerability exists due to missing release of port range register resources in mlxsw_sp_flower_tmplt_create() when parsing flow classification offload templates containing port ranges. A local privileged user can repeatedly trigger creation of these templates to accumulate unreleased register allocations and potentially prevent subsequent operations that require those resources.

3255) Function Call with Incorrectly Specified Arguments (CVE-ID: CVE-2026-98949)

CWE-ID: CWE-628 - Function Call with Incorrectly Specified Arguments

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger inconsistent GPU mapping associations and a kernel warning.

The vulnerability exists due to incorrectly specified function arguments in pvr_vm_gpuva_remap() in the Linux kernel imagination graphics driver when an overlapping mapping splits an existing mapping associated with a different buffer object. A local user can request such a mapping to cause the remaining mapping parts to be linked to the new object's vm_bo rather than the original object's vm_bo, triggering the object-mismatch warning in drm_gpuva_link().

3256) Memory leak (CVE-ID: CVE-2026-98949)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to retain shared memory after mappings are closed, potentially causing a denial of service through memory exhaustion.

The vulnerability exists due to a memory leak in pvr_vm_gpuva_remap() in the Linux kernel imagination graphics driver when an overlapping GPU mapping splits an existing mapping. A local user can repeatedly request overlapping mappings to accumulate unreleased GEM object references and retain backing memory, potentially exhausting available memory.

3257) Numeric Truncation Error (CVE-ID: CVE-2026-98950)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incorrect packet header offset calculations.

The vulnerability exists due to integer truncation in the Linux kernel's bpf_flow_dissect() function when sanitizing packet header offsets with an hlen value greater than 65535. A remote attacker can supply specially crafted packet data to cause the upper bound used for offset clamping to be truncated to 16 bits, resulting in incorrect network and transport header offsets.

3258) Improper update of reference count (CVE-ID: CVE-2026-98953)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to exhaust kernel resources, potentially causing a denial of service.

The vulnerability exists due to improper reference counting in the Linux kernel devlink notification scheduling functions when notification work is already pending or is queued again while running. A local privileged user can repeatedly register and unregister nested devlink instances to leak devlink_rel objects and their indices, potentially exhausting kernel resources and causing a denial of service.

3259) Numeric Truncation Error (CVE-ID: CVE-2026-98955)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect transport-header identification during network packet processing.

The vulnerability exists due to integer truncation in the Linux kernel's __skb_flow_dissect() function when computing transport-header offsets using lengths cast to 16-bit integers before comparison. A local user can supply an oversized packet whose length modulo 65536 is smaller than the computed header offset to cause callers to identify an incorrect location as the transport header, potentially pointing inside the Ethernet header.

3260) Improper Following of Specification by Caller (CVE-ID: CVE-2026-98956)

CWE-ID: CWE-573 - Improper Following of Specification by Caller

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger kernel warnings during audio codec power transitions.

The vulnerability exists due to use of a non-sleeping GPIO API in the ASoC ADAU1372 driver's adau1372_set_power() function when controlling a powerdown GPIO whose provider can sleep. A local user can trigger affected codec power transitions to cause the GPIO API to emit kernel warnings.

3261) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-98957)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service through kernel instability.

The vulnerability exists due to improper resource lifetime management in the mt7915e driver's receive NAPI teardown when removing a device, as NAPI remains enabled when it is destroyed. A local privileged user can unload and reload the module on a system using MT7916 hardware to trigger kernel warnings and system instability, potentially causing a denial of service.

3262) Use of uninitialized resource (CVE-ID: CVE-2026-98959)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt filesystem metadata and cause a denial of service affecting Btrfs filesystem operations.

The vulnerability exists due to use of an incompletely initialized btrfs_dir_item in the Linux kernel's btrfs_setxattr() function when replacing an extended attribute with a differently sized value while multiple attributes share the same item. A local user can create extended attributes with colliding name hashes and replace one attribute's value with a differently sized value to corrupt attribute metadata and trigger a filesystem transaction abort.

3263) Access of Uninitialized Pointer (CVE-ID: CVE-2026-98964)

CWE-ID: CWE-824 - Access of Uninitialized Pointer

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through invalid pointer access in the Linux kernel.

The vulnerability exists due to use of a device pointer before initialization in nvmet_req_alloc_p2pmem_sgls() when the data scatter-gather list allocation succeeds but the metadata allocation fails. A local user can trigger request processing that reaches this failure path to potentially cause a kernel crash, as cleanup passes req->p2p_dev to pci_p2pmem_free_sgl() before the device pointer has been assigned.

3264) Deadlock (CVE-ID: CVE-2026-98967)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a kernel deadlock.

The vulnerability exists due to improper locking in the Chelsio ch_ktls driver's chcr_ktls_dev_del() function and chcr_ktls_dev_add() error path when erasing entries from tid_list with softirqs enabled. A local user can trigger connection cleanup concurrent with receive processing for another connection on the same adapter and CPU to cause a receive softirq to spin on the XArray lock held by the interrupted task, resulting in a deadlock and denial of service.

3265) Use-after-free (CVE-ID: CVE-2026-98968)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by potentially crashing the kernel.

The vulnerability exists due to use-after-free in the Linux kernel AMT driver's amt_dev_xmit() function when a queued General Query is transmitted after its referenced tunnel has expired and been freed. A local user can trigger this condition when a query remains queued longer than the tunnel lifetime, causing a stale tunnel pointer stored in skb->cb to be dereferenced and potentially crashing the kernel.

3266) Out-of-bounds read (CVE-ID: CVE-2026-98969)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose kernel memory.

The vulnerability exists due to an out-of-bounds read in em_text_change() in net/sched/em_text.c when processing a netlink text ematch configuration with an unterminated algorithm name. A local user can supply a 16-byte algo array without a NUL terminator to cause the module-autoload path to read beyond the array and include adjacent memory contents in the usermode helper command line.

Exploitation requires CAP_NET_ADMIN in the target network namespace; obtaining this capability through unshare -Urn is sufficient.

3267) Memory leak (CVE-ID: CVE-2026-98970)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through kernel memory exhaustion.

The vulnerability exists due to failure to release the buffer object cache size list in vc4_bo_cache_destroy() in the Linux kernel VC4 graphics driver when tearing down the cache during driver unbinding. A local privileged user can trigger repeated unbind operations, if permitted, to leak kernel memory and potentially cause a denial of service.

3268) Improper initialization (CVE-ID: CVE-2026-98971)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disrupt device ID allocation and potentially cause a denial of service.

The vulnerability exists due to improper initialization of the stored device ID in gpio_exar_probe() when cleanup-action registration fails during device probing. A local privileged user can trigger a device initialization attempt that encounters this failure to cause exar_devm_ida_free() to release ID 0 instead of the allocated ID, potentially leaking a nonzero ID and incorrectly releasing ID 0 belonging to another device.

3269) NULL pointer dereference (CVE-ID: CVE-2026-98979)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering a kernel fault that blocks subsequent mount operations system-wide.

The vulnerability exists due to an invalid pointer dereference in the Linux kernel mount namespace handling code when attaching an automount beneath an internal mount whose namespace is represented by an error pointer. A local privileged user can access an automount through a descriptor obtained from a fanotify event on an overlay filesystem's lower layer to trigger a fault in count_mounts() while the namespace semaphore is held for writing, blocking subsequent mount operations.

3270) Race condition (CVE-ID: CVE-2026-98980)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose the contents of underlying files normally hidden by overmounted entries.

The vulnerability exists due to improper synchronization in the Linux kernel's reference-based pathname traversal in fs/namei.c when resolving paths concurrently with unlink, rmdir, or rename operations. A local user can race a pathname lookup against an operation that detaches mounts and removes the underlying name to read a covered file if the lookup retains a reference to its dentry but misses the detached mount.

3271) Race condition (CVE-ID: CVE-2026-98984)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to leave mounts persistently attached to removed directories.

The vulnerability exists due to a race condition in the Linux kernel's d_set_mounted() and attach_recursive_mnt() mountpoint handling when attaching a mount to a directory undergoing removal. A local privileged user can race directory removal with moving a bind mount beneath an existing mount between detach_mounts() and d_delete() to attach a mount to the removed directory that will never be detached.

3272) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-98990)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by unmounting mounts that are still in use, disrupting filesystem access.

The vulnerability exists due to a time-of-check time-of-use error in the Linux kernel mount namespace handling in fs/namespace.c when processing successive unmounts during submount shrinking or mount expiry. A local privileged user can trigger unmount operations in a suitable mount tree to make an earlier unmount relocate a busy mount into a later unmount's propagation path, where it is removed without rechecking its reference count, disrupting access to the active mount.

Exploitation requires a mount with MNT_SHRINKABLE, such as an automounted NFS, AFS, or CIFS submount or the tracefs mount below debugfs. Bind mounts inherit this flag.

3273) Improper input validation (CVE-ID: CVE-2026-98992)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to recursively copy an unmounted mount tree, including overmounts that remain attached to it.

The vulnerability exists due to improper validation of mount state in the Linux kernel mount namespace handling code when processing recursive bind-mount requests involving nsfs or pidfs files. A local user can retain a file descriptor to a lazily unmounted bind mount and request a recursive bind mount through that descriptor to copy the unmounted root and its attached overmounts.

3274) Integer underflow (CVE-ID: CVE-2026-99004)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by exhausting system memory and triggering an out-of-memory kernel panic.

The vulnerability exists due to an integer underflow in pvr_mmu_op_context_create() in the Linux kernel's Imagination GPU driver when calculating page table preallocation counts for a mapping that crosses a page table boundary. A local user can trigger such a mapping to cause excessive MMU page allocation, exhausting system memory and triggering an out-of-memory kernel panic.

3275) Race condition (CVE-ID: CVE-2026-99005)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning and taint the kernel.

The vulnerability exists due to a race condition in the i915 driver's RPS work handling when scheduling work concurrently with asynchronous GT parking. A local user can trigger this race so that rps_work() unmasks power-management interrupts after the GT has been parked, causing hardware register access without a runtime power-management wakelock and triggering a kernel warning that taints the kernel.

3276) Release of invalid pointer or reference (CVE-ID: CVE-2026-99006)

CWE-ID: CWE-763 - Release of invalid pointer or reference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through invalid kernel memory deallocation.

The vulnerability exists due to invalid pointer deallocation in the i915 driver's eb_relocate_parse_slow() function when relocation cleanup uses a buffer count increased by the command parser to access entries outside the original exec array. A local user can trigger this execution path to cause kvfree() to operate on pointers obtained from out-of-bounds entries, potentially corrupting kernel memory and crashing the system.

3277) Improper handling of exceptional conditions (CVE-ID: CVE-2026-99007)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning and potentially disrupt framebuffer mode restoration.

The vulnerability exists due to improper handling of probe failures in the Linux kernel DRM framebuffer helper when framebuffer probing fails with an error other than -EAGAIN. A local user can trigger a subsequent framebuffer mode restoration, such as on process exit, to commit stale display configuration with a missing framebuffer, causing a kernel warning and potentially disrupting framebuffer mode restoration.

3278) NULL pointer dereference (CVE-ID: CVE-2026-99008)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel crash.

The vulnerability exists due to a NULL pointer dereference in the Linux kernel Bluetooth RFCOMM function rfcomm_dev_shutdown() when closing a tty whose device registration failed. A local user can open /dev/rfcommN after the RFCOMM device becomes discoverable but before tty registration completes, then close it following a registration failure to trigger a dereference of the unset dev->tty_dev pointer and cause a kernel crash.

3279) Memory leak (CVE-ID: CVE-2026-99010)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to exhaust kernel memory and cause a denial of service.

The vulnerability exists due to a memory leak in the Linux kernel Bluetooth RFCOMM socket callback rfcomm_sk_data_ready() when processing incoming data frames for a connected data link connection whose owner has been cleared. A remote attacker on the local network can send repeated data frames during the interval before the connection closes to accumulate unreleased socket buffers and exhaust kernel memory, causing a denial of service.

3280) Use-after-free (CVE-ID: CVE-2026-99012)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering access to freed kernel socket memory.

The vulnerability exists due to use-after-free in the Linux kernel Bluetooth ISO socket implementation when concurrent connection attempts replace a socket's connection association. A local user can issue concurrent connect calls on the same socket, leaving an old connection associated with a socket that is subsequently freed, to trigger an invalid memory access during a later connection callback and potentially crash the kernel.

3281) Use-after-free (CVE-ID: CVE-2026-99013)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel use-after-free.

The vulnerability exists due to use-after-free in the Linux kernel Bluetooth ISO socket implementation when concurrent listen() calls configure the same broadcast socket. A local user can race these calls to overwrite the socket's connection pointer while leaving an earlier connection referencing the socket, causing subsequent Bluetooth events to access freed socket memory after socket teardown and potentially crash the kernel.

3282) Use-after-free (CVE-ID: CVE-2026-99015)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by crashing the Linux kernel.

The vulnerability exists due to a use-after-free caused by missing synchronization in Bluetooth HCI socket handling when rebinding a socket after its controller is unregistered races with monitor control replay. A local user can trigger concurrent socket rebinding and replay operations to cause a NULL pointer dereference or access to a freed controller object and crash the kernel.

3283) Reliance on Untrusted Inputs in a Security Decision (CVE-ID: CVE-2026-99018)

CWE-ID: CWE-807 - Reliance on Untrusted Inputs in a Security Decision

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write to arbitrary kernel memory and hijack kernel control flow to execute arbitrary code with kernel privileges.

The vulnerability exists due to reliance on a user-controlled register for a security decision in the Linux kernel RISC-V handle_exception() shadow call stack handling when entering the kernel from userspace. A local user can set tp to the linear-map address of the current task_struct and supply a malicious gp value before triggering a trap to bypass the shadow call stack pointer reload, causing kernel functions to write return addresses to attacker-controlled memory and return through attacker-controlled addresses.

Exploitation requires CONFIG_SHADOW_CALL_STACK to be enabled.

3284) Out-of-bounds read (CVE-ID: CVE-2026-99020)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through out-of-bounds kernel memory reads.

The vulnerability exists due to an out-of-bounds read in the Linux kernel tps6594-regulator driver when processing voltage selectors above 0x45 for TPS65224 and TPS652G1 BUCK2-4 regulators. A local user can potentially trigger these lookups to cause reads beyond tps65224_bucks_2_3_4_ranges[], because the descriptors specify four linear ranges although the array contains only two, potentially disrupting kernel operation.

The invalid lookups also occur during normal regulator registration, when the regulator core checks voltage constraints against every selector.

3285) Improper input validation (CVE-ID: CVE-2026-99022)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering a board reboot.

The vulnerability exists due to improper validation of readable register addresses in the Linux kernel LTC3676 regulator driver when processing register dumps through regmap debugfs. A local privileged user can read /sys/kernel/debug/regmap/2-003c/registers to trigger access to the write-only HRST register, causing a hard reset of the chip and rebooting the board.

The CLIRQ register at address 0x1f is also incorrectly treated as readable; reading it triggers the interrupt-clear command.

3286) Use of uninitialized resource (CVE-ID: CVE-2026-99024)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering invalid kernel memory access during OP-TEE device initialization.

The vulnerability exists due to use of uninitialized resources in the Linux kernel OP-TEE driver when TEE devices become accessible before initialization of the associated driver state is complete. A local user can open an accessible TEE device and initiate a session or invoke an operation during this initialization window to trigger use of uninitialized mutexes and a NULL pointer dereference, potentially crashing the kernel.

3287) Excessive Iteration (CVE-ID: CVE-2026-99025)

CWE-ID: CWE-834 - Excessive Iteration

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through CPU starvation, a soft lockup, and a possible kernel panic.

The vulnerability exists due to unbounded softirq processing in the Open vSwitch netlink flow dump when retrieving flow statistics under sustained packet load and voluntary preemption. A local user can initiate a netlink flow dump under these conditions to cause the dumping thread to continuously process the replenished softirq backlog without sleeping or reaching a rescheduling point, preventing other threads from running on the affected CPU.

3288) Uncontrolled Recursion (CVE-ID: CVE-2026-99031)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through kernel stack exhaustion.

The vulnerability exists due to uncontrolled recursion in br_multicast_sg_del_exclude_ports() in the Linux kernel bridge multicast subsystem when removing automatically added STAR_EXCL port groups from source-specific multicast entries. A local user can trigger cleanup of an entry containing a large number of these port groups to exhaust the kernel stack and potentially crash the system.

3289) Use-after-free (CVE-ID: CVE-2026-99032)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel crash.

The vulnerability exists due to a use-after-free in the Linux kernel's smc_getname() function when processing getsockname() calls concurrently with asynchronous CLC socket release. A local user can invoke getsockname() on an SMC socket while link-group termination releases its underlying CLC socket to trigger access to freed memory or a NULL pointer dereference and cause a denial of service.

3290) Improper input validation (CVE-ID: CVE-2026-99033)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering a kernel panic.

The vulnerability exists due to improper validation of link-layer header state in packet_rcv_spkt() when receiving packets from a device without a visible link-layer header. A local privileged user can bind a SOCK_PACKET socket to a CAN interface and cause it to receive a frame with an uninitialized MAC header offset, triggering an invalid skb_push() operation to cause a system-wide denial of service.

The panic occurs in softirq context and terminates the system even with panic_on_oops=0.

3291) Improper resource shutdown or release (CVE-ID: CVE-2026-99034)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through incorrect clock handling during device removal.

The vulnerability exists due to improper runtime power management cleanup in sdhci_sprd_remove() in the Linux kernel's Spreadtrum SDHCI driver when removing a runtime-suspended device. A local privileged user can trigger device removal, if permitted, to disable clocks that runtime power management callbacks may have already disabled, potentially disrupting kernel operation.

3292) Use-after-free (CVE-ID: CVE-2026-99035)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through a kernel crash.

The vulnerability exists due to use-after-free in the mtk-sd MMC host driver when driver unbinding overlaps with an active request timeout callback. A local privileged user can trigger this overlap to cause the callback to access freed host memory, potentially crashing the kernel.

3293) Use-after-free (CVE-ID: CVE-2026-99036)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through a kernel crash.

The vulnerability exists due to a use-after-free in the Linux kernel device-mapper do_resume() function when processing concurrent ioctls on the same device. A local privileged user can race a table swap against an unlocked dm_table_get_mode(new_map) call to trigger a read of freed table memory, potentially causing a kernel crash.

3294) Out-of-bounds read (CVE-ID: CVE-2026-99037)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering a kernel oops.

The vulnerability exists due to an out-of-bounds read in the Linux kernel dm-crypt component when loading a table that combines an AEAD cipher with the lmk initialization vector mode. A local privileged user can load a table containing "capi:gcm(aes)-lmk" with the "integrity:28:aead" option to trigger a kernel oops: lmk sets tfms_count to 64, but crypt_alloc_tfms_aead allocates only one transform, causing crypt_setkey to read beyond the tfms_aead array and pass the resulting values to crypto_aead_setkey.

3295) Race condition (CVE-ID: CVE-2026-99038)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by hanging memory stick host removal and blocking kernel worker threads.

The vulnerability exists due to a race condition in the Linux kernel rtsx_usb_ms driver when device removal overlaps with memory stick request processing. A local user can trigger device removal during a memory stick check to leave a request without completion, causing removal to hang when the memory stick core waits for that request without a timeout.

3296) Use-after-free (CVE-ID: CVE-2026-99039)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory and potentially cause a denial of service.

The vulnerability exists due to use-after-free in the Linux kernel memstick core when device identification or address configuration requests time out while asynchronous processing remains in progress. A local user can trigger request processing that encounters this timeout condition to cause a host controller driver to write into an already freed card structure, potentially crashing the system.

3297) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-99040)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass keyring restrictions and link keys that should be rejected.

The vulnerability exists due to a time-of-check time-of-use race condition in __key_create_or_update() when reading the destination keyring's restriction before acquiring its semaphore. A local user can issue an add_key() call with write permission on the destination keyring and race the installation of a reject-all restriction to link a key using a stale restriction snapshot after restriction installation has completed.

3298) Use-after-free (CVE-ID: CVE-2026-99043)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service through a potential kernel crash.

The vulnerability exists due to use-after-free in the Linux kernel ice driver's ice_eswitch_release_repr() function when a representor is torn down while queued packets still reference its metadata_dst object. A local privileged user can trigger this teardown condition to cause a potential kernel crash when the outstanding references are subsequently used.

3299) Use-after-free (CVE-ID: CVE-2026-99045)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause memory corruption or a denial of service.

The vulnerability exists due to a use-after-free condition in the ibmveth driver's ibmveth_open() error-handling path when receive buffer pool allocation fails after logical LAN registration. A local privileged user can trigger this failure path to leave the Power Hypervisor (PHYP) referencing a buffer-list page after it is unmapped, potentially causing memory corruption or a system crash.

3300) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-99049)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to prevent the Xilinx GPIO controller from entering runtime suspend, leaving its clock enabled.

The vulnerability exists due to a missing runtime power management reference release in xgpio_request() in the Linux kernel Xilinx GPIO driver when pm_runtime_get_sync() fails. A local user can trigger a GPIO request that encounters this failure to leave the usage counter incremented and prevent the controller from entering runtime suspend, because gpiolib does not invoke the matching free callback after a failed request.

3301) Protection mechanism failure (CVE-ID: CVE-2026-99052)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disable SELinux per-file security labeling on shared NFSv4 mounts.

The vulnerability exists due to failure to preserve the SECURITY_LSM_NATIVE_LABELS flag in selinux_set_mnt_opts() when an already-initialized superblock is reused for a second mount. A local privileged user can trigger a second mount of an NFSv4 filesystem exported with security_label to cause nfs_get_root() to clear NFS_CAP_SECURITY_LABEL on the shared nfs_server, disabling per-file labeling for both the original and new mounts.

3302) Use-after-free (CVE-ID: CVE-2026-99053)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through kernel memory corruption.

The vulnerability exists due to use-after-free in the Linux kernel TIPC link-management handlers when processing requests concurrently with timer-driven cleanup of a down peer. A local user can issue link-management requests through generic netlink to trigger access to a freed node and potentially crash the kernel.

3303) Use-after-free (CVE-ID: CVE-2026-99054)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free caused by a teardown race in the Linux kernel TIPC topology server when closing subscriber connections while send and receive workqueues are still running. A local user can exploit concurrent connection activity during topology server shutdown to cause kernel crashes or stalls.

3304) Use-after-free (CVE-ID: CVE-2026-99056)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a kernel crash.

The vulnerability exists due to a race-induced use-after-free in the Linux kernel stream parser when strp_done() tears down parser resources before an in-flight strp_recv() call has completed. A local user can trigger overlapping receive processing and parser teardown to access freed memory and potentially crash the kernel.

Only the espintcp user of the stream parser is affected by this race condition.

3305) Memory leak (CVE-ID: CVE-2026-99057)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to exhaust kernel memory and cause a denial of service.

The vulnerability exists due to a memory leak in the Xen netfront driver's xennet_poll() error handling when processing response chains with more slots than fit in an skb's fragments. A local privileged user can control the backend to repeatedly supply oversized response chains, leaving the dequeued skb and its attached fragment pages unfreed, to exhaust kernel memory and cause a denial of service.

3306) NULL pointer dereference (CVE-ID: CVE-2026-99058)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering a kernel fault.

The vulnerability exists due to a NULL pointer dereference in is_chained_work() in kernel/workqueue.c when a kernel worker outside work-item execution queues work on a draining or destroying workqueue. A local user can potentially trigger this condition to cause the chained-work check to dereference a NULL worker->current_pwq pointer and fault.

3307) Race condition (CVE-ID: CVE-2026-99059)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause WireGuard to establish the same cryptographic session more than once.

The vulnerability exists due to a race condition in WireGuard's Noise handshake processing when duplicate handshake responses are processed concurrently with an intervening handshake initiation. A remote attacker can replay a handshake response under this timing condition to cause stale handshake state to be accepted and the same session to be established more than once.

3308) NULL pointer dereference (CVE-ID: CVE-2026-99060)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering a kernel NULL pointer dereference.

The vulnerability exists due to missing initialization of the driver-private global station WCID in the Linux kernel's mt7603 wireless driver when queuing frames that have neither a station nor a virtual interface. A local privileged user can inject a frame through a monitor interface to make __skb_queue_tail() dereference a NULL prev pointer in an uninitialized sk_buff_head, causing a kernel fault.

3309) Use-after-free (CVE-ID: CVE-2026-99061)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by crashing the kernel.

The vulnerability exists due to a use-after-free caused by a race condition in the brcmfmac driver's brcmf_detach() function when driver removal overlaps with removal of a P2P device interface by an exiting user-space process. A local privileged user can remove the driver while the process that created the P2P device is still exiting to trigger duplicate interface unregistration and access to freed memory, causing a kernel crash.

3310) Integer underflow (CVE-ID: CVE-2026-99062)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disrupt VSOCK stream reception and socket readiness reporting.

The vulnerability exists due to an integer underflow in virtio_transport_read_skb() when dequeuing a partially consumed stream packet. A local user can trigger subtraction of the full packet length rather than the remaining unread length from rx_bytes to corrupt receive accounting, cause erroneous receive failures, and hide queued data from socket reads.

The demonstrated behavior involves a connected CID_LOCAL stream with an SK_SKB verdict.

3311) Out-of-bounds read (CVE-ID: CVE-2026-99063)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disclose seven bytes of kernel memory beyond an allocated buffer.

The vulnerability exists due to an out-of-bounds read in the Linux kernel device-mapper ioctl implementation when get_result_buffer() sets data_start beyond the end of a minimum-sized buffer. A local privileged user can issue a DM_LIST_DEVICES ioctl with data_size set to 305 to cause ctl_ioctl() to copy seven bytes beyond the allocation back to userspace.

3312) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-99067)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially exhaust kernel resources and cause a denial of service.

The vulnerability exists due to missing release of a filesystem root reference in the Linux kernel Btrfs scrub_print_warning_inode() function when inode path resolution fails while printing scrub warnings. A local user can trigger repeated failures in this error path to accumulate unreleased root references, potentially exhausting kernel resources and causing a denial of service.

3313) Race condition (CVE-ID: CVE-2026-99070)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger spurious kernel warnings.

The vulnerability exists due to a race condition in the Linux kernel IPv6 route notification function fib6_info_hw_flags_set() when calculating notification sizes and filling notification buffers using separate snapshots. A local privileged user can trigger concurrent nexthop group replacement during notification construction to cause rt6_fill_node() to return -EMSGSIZE and trigger an unwarranted kernel warning.

The race requires nexthop compatibility mode to be enabled.

3314) Race condition (CVE-ID: CVE-2026-99071)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger a spurious kernel warning.

The vulnerability exists due to a race condition in fib_alias_hw_flags_set() when sizing and populating asynchronous IPv4 route notifications using independent snapshots protected only by RCU. A local privileged user can trigger concurrent route updates to cause a spurious kernel warning if nexthop group replacement increases the notification size between these snapshots and fib_dump_info() returns -EMSGSIZE.

The race requires nexthop compatibility mode to be enabled.

3315) NULL pointer dereference (CVE-ID: CVE-2026-99072)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service through a kernel crash.

The vulnerability exists due to a NULL pointer dereference in IPv4 route notification sizing when a nexthop group shrinks during asynchronous hardware flag notification processing. A local privileged user can trigger replacement of a nexthop group with fewer paths while fib_nlmsg_size() iterates over it, causing fib_info_nhc() to return NULL that fib_nexthop_nlmsg_size() dereferences, to cause a denial of service.

3316) NULL pointer dereference (CVE-ID: CVE-2026-99074)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel NULL pointer dereference.

The vulnerability exists due to a NULL pointer dereference in the IPv4 PMTU update path in net/ipv4/route.c when a nexthop group shrinks during path iteration. A local user can replace a nexthop group concurrently with PMTU updates so that fib_info_nhc() returns NULL for a previously accepted index, causing update_or_create_fnhe() to dereference it and crash the kernel.

Nexthop group replacement requires CAP_NET_ADMIN in the network namespace. Where unprivileged user namespaces are permitted, this capability can be obtained in a new user and network namespace.

3317) Double free (CVE-ID: CVE-2026-99078)

CWE-ID: CWE-415 - Double Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through kernel memory corruption.

The vulnerability exists due to a double free in the mlx5e AF_XDP receive-buffer handling code when retrying an MPWQE refill after an allocation failure on a striding receive queue. A local user can exercise this failure-and-retry path to cause xsk_buff_free() to release buffers through stale pointers after the frames have returned to the XSK pool and been reallocated, potentially corrupting kernel memory and causing a denial of service.

3318) Double free (CVE-ID: CVE-2026-99079)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disrupt packet processing and potentially corrupt packet data.

The vulnerability exists due to a double free in the mlx5e driver's AF_XDP receive-buffer handling when an XDP redirect encounters a full socket RX ring and a subsequent batched refill of a legacy cyclic receive queue succeeds only partially. A remote attacker can send network traffic that triggers these conditions to cause a refill retry to release a live buffer through a stale pointer and publish the same UMEM frame twice, disrupting packet processing and potentially corrupting packet data.

3319) Memory leak (CVE-ID: CVE-2026-99080)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to exhaust kernel memory and potentially cause a denial of service.

The vulnerability exists due to a memory leak involving xarray nodes in filesystem inode cleanup when handling madvise operations. A local user can invoke madvise to trigger xarray node leaks, potentially exhausting kernel memory and causing a denial of service.

3320) Out-of-bounds read (CVE-ID: CVE-2026-99081)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through network transmit queue timeouts.

The vulnerability exists due to an out-of-bounds read in the Linux kernel bnxt_en driver's bnxt_start_xmit() function when transmitting small packets whose padded length exceeds their DMA mapping length. A local user can trigger transmission of small packets with data positioned near a page boundary to cause the NIC to read beyond the DMA-mapped region, triggering IOMMU faults and transmit queue timeouts.

3321) Use of Uninitialized Variable (CVE-ID: CVE-2026-99088)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a harmless kernel debug warning.

The vulnerability exists due to use of an uninitialized transport-header offset in the Linux kernel Open vSwitch update_ipv6_checksum() function when rewriting IPv6 addresses in non-first IPv6 fragments. A local user can submit a non-first IPv6 fragment for address rewriting to trigger the warning.

The warning occurs with CONFIG_DEBUG_NET=y.

3322) Improper update of reference count (CVE-ID: CVE-2026-99089)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger kernel warnings and potentially disrupt audio device operation.

The vulnerability exists due to improper clock reference counting in the Samsung I2S driver when suspending a device whose operating clock was not enabled during probing. A local user can trigger runtime power-management suspension to cause an unmatched clock disable, producing a kernel warning and potentially disrupting audio device operation.

3323) Missing Synchronization (CVE-ID: CVE-2026-99090)

CWE-ID: CWE-820 - Missing Synchronization

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning and set the TAINT_WARN flag during GPU recovery on systems with lockdep enabled.

The vulnerability exists due to missing synchronization in the amdgpu_get_vblank_counter_kms() callback when reading display registers and scanout position during GPU reset. A local user can cause vblank counter reads to overlap GPU recovery to trigger the lockdep assertion in amdgpu_device_skip_hw_access() and set TAINT_WARN when lockdep is enabled.

3324) Return of Wrong Status Code (CVE-ID: CVE-2026-99091)

CWE-ID: CWE-393 - Return of Wrong Status Code

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service in Bluetooth management clients that mishandle incorrectly reported command success.

The vulnerability exists due to incorrect status propagation in the Linux kernel Bluetooth management function cmd_complete_rsp() when pending commands are flushed during adapter power-off or removal. A local user can trigger these conditions while a command without a completion callback is pending to cause the socket pointer's first byte to be returned as the command status instead of the intended error status. An incorrect success response with no parameters can crash affected clients, as observed with bluetoothd 5.72 handling a pending Start Discovery command.

3325) Use-after-free (CVE-ID: CVE-2026-99095)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a kernel crash.

The vulnerability exists due to use-after-free in the Linux kernel VC4 V3D driver when pending timer and work callbacks execute during device teardown. A local user can exercise GPU job processing that leaves callbacks pending at V3D unbind to potentially trigger access to freed device memory and cause a denial of service.

3326) Improper input validation (CVE-ID: CVE-2026-99999)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt IPv4 packet headers and potentially compromise system confidentiality, integrity, and availability.

The vulnerability exists due to improper validation of the checksum start offset in the Linux kernel IPv4 checksum-completion paths when processing packets with invalid checksum metadata. A remote attacker can introduce a packet whose checksum start offset precedes the end of its IPv4 header into an affected processing path to cause skb_checksum_help to corrupt the network header, potentially compromising system confidentiality, integrity, and availability.